Threats tagged 'ghsa-922w-gjph-r2q7'

A vulnerability in github.com/eclipse-keypont/crypto11/v2 versions from 2.0.0-rc3 through 2.0.0-rc8 allows an attacker to compromise the confidentiality of shared secrets. The ML-KEM key-pair lookup functions do not verify that the public key matches the private key, enabling an attacker who can open an unauthenticated session and plant a public key object with victim identifiers to receive shared secrets intended for the victim. Versions prior to 2.0.0-rc3 and after 2.0.0-rc8, as well as v1 module paths, are not affected.