Lucene search

K
osvGoogleOSV:GO-2023-2003
HistoryAug 10, 2023 - 10:06 p.m.

Group signature validation bypass in github.com/supranational/blst

2023-08-1022:06:06
Google
osv.dev
4
github
blst
signature

AI Score

7.1

Confidence

Low

When complemented with a check for infinity, blst skips performing a signature group-check. Formally speaking, infinity is the identity element of the elliptic curve group and as such it is a member of the group, so the group-check should be performed. The fix performs the check even in the presence of infinity.

AI Score

7.1

Confidence

Low