From c69fd603000ac4d0ccf23250aa05cc3d486cd975 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 17 Mar 2025 14:50:09 +0000
Subject: [PATCH] Publish GHSA-v432-7f47-9g94

---
 .../GHSA-v432-7f47-9g94.json                  | 58 +++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/03/GHSA-v432-7f47-9g94/GHSA-v432-7f47-9g94.json

diff --git a/advisories/github-reviewed/2025/03/GHSA-v432-7f47-9g94/GHSA-v432-7f47-9g94.json b/advisories/github-reviewed/2025/03/GHSA-v432-7f47-9g94/GHSA-v432-7f47-9g94.json
new file mode 100644
index 00000000000..39f1cb049a9
--- /dev/null
+++ b/advisories/github-reviewed/2025/03/GHSA-v432-7f47-9g94/GHSA-v432-7f47-9g94.json
@@ -0,0 +1,58 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-v432-7f47-9g94",
+  "modified": "2025-03-17T14:48:07Z",
+  "published": "2025-03-17T14:48:07Z",
+  "aliases": [],
+  "summary": "PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash",
+  "details": "## Summary\nPostQuantum-Feldman-VSS, in versions ≤0.7.6b0, is vulnerable due to its dependency on gmpy2, which can crash the Python interpreter if memory allocation fails. This can be exploited for denial-of-service attacks, impacting the availability of systems using the library.\n\n## Description\nThe vulnerability arises from gmpy2’s behavior, as noted in its documentation: \n\n> gmpy2 can crash the Python interpreter in case of memory allocation failure ([gmpy2 Overview](https://gmpy2.readthedocs.io/en/latest/overview.html))\n\nThis stems from gmpy2’s reliance on the GMP library, which terminates the program when memory allocation fails ([GMP Memory Management](https://gmplib.org/manual/Memory-Management)). An attacker can exploit this by crafting inputs that exhaust memory, causing the interpreter to crash and disrupting service for legitimate users.\n\n## Impact\n- **Availability**: High impact, as the interpreter crash leads to complete denial of service.\n- **Confidentiality and Integrity**: No direct impact, as the vulnerability does not allow unauthorized access or data modification.\n\n## Affected Versions\n- All versions of PostQuantum-Feldman-VSS ≤0.7.6b0\n\n## Patched Versions\n- Versions >0.7.6b0 (e.g., 0.7.7 or later, once released with the `SafeGMPy2` implementation)\n\n## Workarounds (For Vulnerable Versions)\nFor users unable to upgrade to a patched version:\n- **Estimate Memory Usage**: Manually estimate memory requirements before operations and ensure sufficient resources.\n- **Monitor System Resources**: Implement monitoring to detect and respond to memory exhaustion attempts.\n- **Custom Memory Allocation**: Use GMP’s custom allocation functions to handle failures gracefully ([GMP Custom Allocation](https://gmplib.org/manual/Custom-Allocation)).\n\n## Mitigation Details\nThe fix introduces a `SafeGMPy2` wrapper that:\n1. Checks input sizes against configurable limits (e.g., `DEFAULT_MAX_BITS_POWMOD = 20000`).\n2. Estimates output sizes to prevent excessive memory use (e.g., in multiplication and powmod).\n3. Wraps critical gmpy2 functions (mpz, powmod, invert) with try-except blocks to raise `MemorySafetyError` instead of crashing.\n4. Monkey-patches gmpy2 to enforce these safety checks globally.\nThis has been integrated into key classes like `CyclicGroup` and `FeldmanVSS`, ensuring memory-safe cryptographic operations.\n\n## References\n- [gmpy2 Overview Documentation](https://gmpy2.readthedocs.io/en/latest/overview.html)\n- [GMP Memory Management Documentation](https://gmplib.org/manual/Memory-Management)\n- [GMP Custom Allocation Documentation](https://gmplib.org/manual/Custom-Allocation)",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "PostQuantum-Feldman-VSS"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.7.7b0"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 0.7.6b0"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/DavidOsipov/PostQuantum-Feldman-VSS/security/advisories/GHSA-v432-7f47-9g94"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/DavidOsipov/PostQuantum-Feldman-VSS"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-400"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-17T14:48:07Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file