Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
For a hybrid KEM public key of type `PublicKey::WingKemDraft06` or `PublicKey::X25519MlKem768Draft06`, the `PublicKey::encapsulate_derand` function would panic in an indexing operation on a seed input of length shorter than 32 bytes. Impact Applications encapsulating with an attacker controlled seed value could be made to panic. Since the encapsulation seed should be considered a secret of the encapsulating party for the KEM to remain secure, an application should never take the seed value from a potentially attacker controlled source. Mitigation With release of version `0.0.10` of `libcrux-kem` this bug has been fixed and the serialization functions return `InvalidPrivateKey` and `InvalidPublicKey` errors on invalid input buffer lengths. We recommend users upgrade to `libcrux-kem` version `0.0.10`.
Recommended action: Upgrade to 0.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The deserialization functions `X25519MlKem768Draft00PrivateKey::decode` `X25519MlKem768Draft00PublicKey::decode` and `XWingKemDraft06PublicKey::decode` would panic during an indexing operation when provided an input slice that is shorter than the length of the given key type, i.e. shorter than 2400 bytes in the case of the `X25519MlKem768Draft00` private key and shorter than 1184 bytes in the case of the `X25519MlKem768Draft` and `XWingKemDraft06` public keys. Impact Applications decoding attacker provided slices into the above mentioned private and public key types could be made to panic. Mitigation With release of version `0.0.10` of `libcrux-kem` this bug has been fixed and the serialization functions return `InvalidPrivateKey` and `InvalidPublicKey` errors on invalid input buffer lengths. We recommend users upgrade to `libcrux-kem` version `0.0.10`.
Recommended action: Upgrade to 0.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.