OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-01-01 09:10:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add advisory for libsecp256k1 (#963)

Browse Source 
* add advisory

* fix formatting
This commit is contained in:
Martin Pugh
2021-07-13 14:46:23 +02:00
committed by GitHub
parent 4792a373b1
commit e95d360049
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
crates/libsecp256k1/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,18 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "libsecp256k1"
date = "2021-07-13"
url = "https://github.com/paritytech/libsecp256k1/pull/67"
categories = ["crypto-failure"]
[versions]
patched = [">= 0.5.0"]
```
# libsecp256k1 allows overflowing signatures
libsecp256k1 accepts signatures whose R or S parameter is larger than the
secp256k1 curve order, which differs from other implementations. This could
lead to invalid signatures being verified.
The error is resolved in 0.5.0 by adding a `check_overflow` flag.