Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

libcrux-ecdh

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    Bug-Fixes in libcrux-ecdh, libcrux-ed25519, libcrux-psq

    GHSA-435g-fcv3-8j26

    Affected
    • crates.io libcrux-ecdh <= 0.0.5
    Fixed in
    0.0.6· Vendor fix available
    Issue
    In accordance with our security policy for libcrux, we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the libcrux-ecdh, libcrux-ed25519 and libcrux-psq crates contain the following bug-fixes: libcrux-ecdh - #1301: Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length libcrux-ed25519 - #1320: Remove duplicated clamping step during key generation The issue fixed in #1320 was first reported by Nadim Kobeissi. libcrux-psq - #1319: Propagate AEADError instead of panicking - #1301: Fix broken clamping check for imported X25519 secret keys The issue fixed in #1319 was first reported by Nadim Kobeissi.

    Recommended action: Upgrade to 0.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →