Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The AVX2 implementation of ML-DSA verification incorrectly implemented the usehint function, mishandling an edge case that should lead to signature rejection. Impact An attacker could make the ML-DSA verifier accept a crafted invalid signature under a maliciously generated verification key, if the AVX2 implementation is used. Mitigation From version 0.0.9 the edge case is handled correctly and invalid signatures are rejected.
Recommended action: Upgrade to 0.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The ML-DSA verification algorithm as specified in FIPS 204, subsection 6.3 requires verifiers to check that the infinity norm of the deserialized signer response $z$ does not exceed $\gamma1 - \beta$ (line 13 of Algorithm 8). The same check is required to be performed during signature generation. libcrux-ml-dsa did not perform this check correctly during signature verification, accepting signatures with signer response norm above the allowed maximum value. The check is correctly performed during signing. Impact Applications using libcrux-ml-dsa for signature verification would have accepted signatures that would be rejected by a conforming implementation. Mitigation Starting from version 0.0.8, signature verification uses the correct value for $\gamma1$ in the signer response norm check.
Recommended action: Upgrade to 0.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
During ML-DSA verification the serialized hint values are decoded as specified in algorithm 22 HintBitUnpack of FIPS 204, subsection 7.1. The algorithm requires that the cumulative hint counters per row of the hint vector are strictly increasing and below a maximum value which depends on the choice of ML-DSA parameter set (line 4). In libcrux-ml-dsa, hint decoding did not check the boundedness of the cumulative hint counter of the last row of the hint vector. Impact A manipulated invalid hint can cause an out-of-bounds memory access since the hint decoding logic may attempt to read outside the bounds of the serialized signature, causing a runtime panic. Mitigation Starting from version 0.0.8, hint decoding will check the cumulative hint counter of the last row as well.
Recommended action: Upgrade to 0.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On platforms without the core::arch::aarch64::vxarqu64 intrinsic, an unverified fallback in libcrux-intrinsics v0.0.3 passed incorrect arguments and produced wrong results. This corrupted SHA-3 digests and caused libcrux-ml-kem and libcrux-ml-dsa to sample incorrectly, yielding incorrect shared secrets and invalid signatures. The issue has been fixed in v0.0.4.
Recommended action: Upgrade to 0.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.