diff --git a/data/osv/GO-2024-2453.json b/data/osv/GO-2024-2453.json new file mode 100644 index 00000000..4bb704cd --- /dev/null +++ b/data/osv/GO-2024-2453.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2024-2453", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-9763-4f94-gfch" + ], + "summary": "Timing side channel in github.com/cloudflare/circl", + "details": "Timing side channel in github.com/cloudflare/circl", + "affected": [ + { + "package": { + "name": "github.com/cloudflare/circl", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.3.7" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/cloudflare/circl/pke/kyber/internal/common", + "symbols": [ + "Poly.CompressTo" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/cloudflare/circl/security/advisories/GHSA-9763-4f94-gfch" + }, + { + "type": "FIX", + "url": "https://github.com/cloudflare/circl/commit/75ef91e8a2f438e6ce2b6e620d236add8be1887d" + }, + { + "type": "WEB", + "url": "https://kyberslash.cr.yp.to/" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2024-2453" + } +} \ No newline at end of file diff --git a/data/reports/GO-2024-2453.yaml b/data/reports/GO-2024-2453.yaml new file mode 100644 index 00000000..1aad65dd --- /dev/null +++ b/data/reports/GO-2024-2453.yaml @@ -0,0 +1,17 @@ +id: GO-2024-2453 +modules: + - module: github.com/cloudflare/circl + versions: + - fixed: 1.3.7 + vulnerable_at: 1.3.6 + packages: + - package: github.com/cloudflare/circl/pke/kyber/internal/common + symbols: + - Poly.CompressTo +summary: Timing side channel in github.com/cloudflare/circl +ghsas: + - GHSA-9763-4f94-gfch +references: + - advisory: https://github.com/cloudflare/circl/security/advisories/GHSA-9763-4f94-gfch + - fix: https://github.com/cloudflare/circl/commit/75ef91e8a2f438e6ce2b6e620d236add8be1887d + - web: https://kyberslash.cr.yp.to/