CIRCL's Kyber: timing side-channel (kyberslash2)

Impact On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn parts of the secret key. Does not apply to ephemeral usage, such as when used in the regular way in TLS. Patches Patched in 1.3.7. References - kyberslash.cr.yp.to...

CVE-2023-24626

creationtimestamp| type| source ---|---|--- 2023-12-10 13:28:43+00:00| seen| https://t.me/arpsyndicate/1627 2025-05-09 20:26:18+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15842 2025-05-14 13:48:57+00:00| seen|...

CVE-2023-22524

creationtimestamp| type| source ---|---|--- 2023-12-06 16:45:05+00:00| seen| https://t.me/truesecator/5170 2023-12-06 18:10:13+00:00| seen| https://t.me/alexmakus/5195 2023-12-07 11:09:25+00:00| seen| https://t.me/kasperskyb2b/1053 2023-12-14 15:48:07+00:00| published-proof-of-concept|...

CVE-2023-40077

creationtimestamp| type| source ---|---|--- 2023-12-05 10:46:49+00:00| seen| https://t.me/truesecator/5162 2023-12-05 12:58:09+00:00| seen| https://t.me/darkcommunityofficial/156 2023-12-23 17:51:51+00:00| seen| https://t.me/ctinow/158881 2024-10-14 15:50:35+00:00| seen|...

CVE-2022-40507

creationtimestamp| type| source ---|---|--- 2023-12-05 10:46:49+00:00| seen| https://t.me/truesecator/5162 2023-12-05 12:58:09+00:00| seen| https://t.me/darkcommunityofficial/156 2024-10-14 15:50:35+00:00| seen| https://vulnerability.circl.lu/bundle/92582bf5-d92c-47fe-b891-656d271bbfef 2025-01-07...

CVE-2023-3446

creationtimestamp| type| source ---|---|--- 2023-11-17 06:28:22+00:00| seen| https://t.me/arpsyndicate/222 2023-12-02 02:17:52+00:00| seen| https://t.me/arpsyndicate/879 2023-12-02 02:24:58+00:00| seen| https://t.me/arpsyndicate/881 2024-11-14 12:00:00+00:00| seen|...

The vulnerability of the Read() function in the open-source cryptographic algorithm library Circl allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Read function in the open-source cryptographic algorithm library Circl is related to insufficient validation of input data and the failure to eliminate instructions in dynamically executed code. Exploiting this vulnerability can allow attackers to compromise the...

CVE-2023-42669

creationtimestamp| type| source ---|---|--- 2023-11-06 12:25:43+00:00| seen| https://t.me/cibsecurity/73581 2026-01-21 21:18:16+00:00| seen| https://vulnerability.circl.lu/bundle/bbcbc485-b88d-4831-b8e9-6e37e7bd9875...

CVE-2023-40139

creationtimestamp| type| source ---|---|--- 2023-10-28 06:42:35+00:00| seen| https://t.me/cibsecurity/73080 2025-02-03 19:33:09+00:00| seen| https://vulnerability.circl.lu/bundle/cf59c148-4047-4ccd-8ba0-26fb7197899c...

CVE-2023-40135

creationtimestamp| type| source ---|---|--- 2023-10-28 00:17:32+00:00| seen| https://t.me/cibsecurity/73092 2025-02-03 19:33:09+00:00| seen| https://vulnerability.circl.lu/bundle/cf59c148-4047-4ccd-8ba0-26fb7197899c...

CVE-2023-36584

creationtimestamp| type| source ---|---|--- 2023-10-10 22:22:53+00:00| seen| https://t.me/cibsecurity/72011 2023-11-16 18:10:02+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-11-17 07:02:15+00:00| exploited| https://t.me/thehackernews/4162 2023-11-17 07:07:36+00:00| seen|...

CVE-2023-4047

creationtimestamp| type| source ---|---|--- 2023-08-01 18:38:28+00:00| seen| https://t.me/cibsecurity/67503 2023-08-02 18:10:05+00:00| seen| https://t.me/truesecator/4685 2023-09-20 10:12:47+00:00| published-proof-of-concept| Telegram/OrzbdSrsyNGre50gvdWTC8vdVTcvnVlN80j6OCu5SA6tOfA 2023-09-20...

Insecure Randomness

github.com/cloudflare/circl is vulnerable to Insecure Randomness. Kyber and FrodoKEM did not check whether crypto/rand.Read returned an error, leading to a predictable shared secret. The tkn20 and blindrsa components did not check if enough randomness was returned from the user provided randomnes...

GHSA-2Q89-485C-9J2X Improper random reading in CIRCL

Impact When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did...

Improper random reading in CIRCL

Impact When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did...

CIRCL 安全漏洞

CIRCL is an open source collection of cryptographic primitives written in Go by Cloudflare. CIRCL has a security vulnerability that stems from the fact that the tkn20 and blindrsa components do not check whether a user-supplied random source returns sufficient randomness...

PT-2023-6901 · Circl · Circl

Name of the Vulnerable Software and Affected Versions: CIRCL versions prior to 1.3.3 Description: The issue arises from insufficient input validation and lack of measures to neutralize instructions in dynamically executed code in the crypto/rand.Read function. This could lead to a predictable...

CVE-2023-1393

creationtimestamp| type| source ---|---|--- 2023-03-31 00:31:47+00:00| seen| https://t.me/cibsecurity/61207 2026-01-21 21:18:16+00:00| seen| https://vulnerability.circl.lu/bundle/bbcbc485-b88d-4831-b8e9-6e37e7bd9875...

CVE-2023-28503

creationtimestamp| type| source ---|---|--- 2023-03-30 00:16:03+00:00| seen| https://t.me/cibsecurity/61150 2023-04-12 09:58:37+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/unidataudadminauthbypass.rb 2024-01-07 05:30:41+00:00| seen|...

CVE-2023-25194

creationtimestamp| type| source ---|---|--- 2023-02-14 06:59:01+00:00| published-proof-of-concept| Telegram/UgjyfN33Nakq6MmMsTBw0rSSkp77M7XZKGq62f2fQ8miTg 2023-02-14 19:43:14+00:00| published-proof-of-concept| https://t.me/malwar3s/32 2023-02-20 06:51:35+00:00| seen| https://t.me/cKure/10688...