Publish GHSA-9763-4f94-gfch

advisories/github-reviewed/2024/01/GHSA-9763-4f94-gfch/GHSA-9763-4f94-gfch.json

@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9763-4f94-gfch",
+  "modified": "2024-01-08T16:45:05Z",
+  "published": "2024-01-08T16:45:05Z",
+  "aliases": [
+
+  ],
+  "summary": "CIRCL's Kyber: timing side-channel (kyberslash2)",
+  "details": "### Impact\nOn some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key.\n\nDoes not apply to ephemeral usage, such as when used in the regular way in TLS.\n\n### Patches\nPatched in 1.3.7.\n\n### References\n- [kyberslash.cr.yp.to](https://kyberslash.cr.yp.to/)",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/cloudflare/circl"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.3.7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/cloudflare/circl/security/advisories/GHSA-9763-4f94-gfch"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/cloudflare/circl/commit/75ef91e8a2f438e6ce2b6e620d236add8be1887d"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/cloudflare/circl"
+    },
+    {
+      "type": "WEB",
+      "url": "https://kyberslash.cr.yp.to/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-08T16:45:05Z",
+    "nvd_published_at": null
+  }
+}