CVE-2023-44273
Critical
Description
Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.
SeverityCritical
CVSS9.8
Exploit probability—
ProductConsensys Gnark-crypto
PublishedSep 28, 2023
First seenSep 28, 2023
How to fix
Update
- consensys gnark-crypto0.12.0 or later
- github.com/Consensys/gnark-crypto0.12.0 or later
- github.com/consensys/gnark-crypto0.12.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| consensys gnark-crypto | v < 0.12.0 | 0.12.0 |
| github.com/Consensys/gnark-cryptoGo | v < 0.12.0 | 0.12.0 |
| github.com/consensys/gnark-cryptoGo | v < 0.12.0 | 0.12.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.