High, CVSS 8.7PyPIAmendedPublished
PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash
GHSA-v432-7f47-9g94
- Affected
- PyPI postquantum-feldman-vss <= 0.7.6b0
- Fixed in
- 0.7.7b0· Vendor fix available
- Issue
- PostQuantum-Feldman-VSS, a Python library implementing Feldman's Verifiable Secret Sharing scheme with post-quantum security, was vulnerable to denial-of-service attacks in versions up to and including 0.7.6b0. This vulnerability stems from the library's reliance on the gmpy2 library for arbitrary-precision arithmetic. gmpy2, in turn, depends on the GNU Multiple Precision Arithmetic Library (GMP). GMP, by design, terminates the process when it cannot allocate memory. An attacker could exploit this by providing carefully crafted inputs that cause gmpy2 to attempt to allocate extremely large amounts of memory, leading to a crash of the Python interpreter and thus a denial of service. Vulnerability Details: The core issue lies in the behavior of GMP (and thus, gmpy2) when memory allocation fails. Instead of raising a standard Python exception that could be caught and handled, GMP terminates the entire process. This behavior is documented in the GMP and gmpy2 documentation:…
Recommended action: Upgrade to 0.7.7b0 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.