diff --git a/crates/cggmp21/RUSTSEC-0000-0000.md b/crates/cggmp21/RUSTSEC-0000-0000.md new file mode 100644 index 00000000..706a1d75 --- /dev/null +++ b/crates/cggmp21/RUSTSEC-0000-0000.md @@ -0,0 +1,23 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "cggmp21" +date = "2025-11-24" +url = "https://www.dfns.co/article/cggmp21-vulnerabilities-patched-and-explained" +categories = ["crypto-failure"] +keywords = ["zk-proof"] +aliases = ["CVE-2025-66016"] +[versions] +patched = [">= 0.6.3"] +``` + +# Missing check in ZK proof in CGGMP21 Threshold Signing Protocol + +Vulnerability concerns a missing check in the ZK proof that enables an attack in which single malicious signer can reconstruct full private key. + +### Patches +* `cggmp21 v0.6.3` is a patch release that contains a fix that introduces this specific missing check. +* However, we recommend upgrading to `cggmp24 v0.7.0-alpha.2` in which we've introduced many other security checks as a precaution. Follow the [migration guidelines](https://github.com/LFDT-Lockness/cggmp21/blob/v0.7.0-alpha.2/CGGMP21_MIGRATION.md) to upgrade. + +### References +Read our [blog post](https://www.dfns.co/article/cggmp21-vulnerabilities-patched-and-explained) to learn more. diff --git a/crates/cggmp24/RUSTSEC-0000-0000.md b/crates/cggmp24/RUSTSEC-0000-0000.md new file mode 100644 index 00000000..1c8a5bad --- /dev/null +++ b/crates/cggmp24/RUSTSEC-0000-0000.md @@ -0,0 +1,24 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "cggmp24" +date = "2025-11-24" +url = "https://www.dfns.co/article/cggmp21-vulnerabilities-patched-and-explained" +categories = ["crypto-failure"] +keywords = ["zk-proof"] +aliases = ["CVE-2025-66016"] +[versions] +patched = [">= 0.7.0-alpha.2"] +``` + +# Missing check in ZK proof in CGGMP21 Threshold Signing Protocol + +Vulnerability concerns a missing check in the ZK proof that enables an attack in which single malicious signer can reconstruct full private key. + +### Patches +* `cggmp21 v0.6.3` is a patch release that contains a fix that introduces this specific missing check. +* However, we recommend upgrading to `cggmp24 v0.7.0-alpha.2` in which we've introduced many other security checks as a precaution. Follow the [migration guidelines](https://github.com/LFDT-Lockness/cggmp21/blob/v0.7.0-alpha.2/CGGMP21_MIGRATION.md) to upgrade. + +### References +Read our [blog post](https://www.dfns.co/article/cggmp21-vulnerabilities-patched-and-explained) to learn more. +