Skip to content

Commit e95d360

Browse files
authored
Add advisory for libsecp256k1 (#963)
* add advisory * fix formatting
1 parent 4792a37 commit e95d360

File tree

1 file changed

+18
-0
lines changed

1 file changed

+18
-0
lines changed
Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "libsecp256k1"
5+
date = "2021-07-13"
6+
url = "https://github.com/paritytech/libsecp256k1/pull/67"
7+
categories = ["crypto-failure"]
8+
[versions]
9+
patched = [">= 0.5.0"]
10+
```
11+
12+
# libsecp256k1 allows overflowing signatures
13+
14+
libsecp256k1 accepts signatures whose R or S parameter is larger than the
15+
secp256k1 curve order, which differs from other implementations. This could
16+
lead to invalid signatures being verified.
17+
18+
The error is resolved in 0.5.0 by adding a `check_overflow` flag.

0 commit comments

Comments
 (0)