{"id":"GHSA-wgq8-vr6r-mqxm","summary":"frost-core: refresh shares with smaller min_signers will reduce security of group","details":"### Impact\n\nIt was not clear that it is not possible to change `min_signers` (i.e. the threshold) with the refresh share functionality (`frost_core::keys::refresh` module). Using a smaller value would not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after refreshing the shares with a smaller threshold, it would still be possible to sign with the original threshold; however, this could cause a security loss to the participant's shares. We have not determined the exact security implications of doing so and judged simpler to just validate `min_signers`. \n\n If for some reason you have done a refresh share procedure with a smaller `min_signers` we strongly recommend migrating to a new key. \n\n### Patches\n\nUpdating to 2.2.0 will ensure that the `min_signers` parameter will be validated. However it won't restore the security of groups refreshed with a smaller `min_signers` parameters.\n\n### Workarounds\n\nYou don't need to update if you don't use the refresh share functionality, or if you didn't try to change the `min_signers` parameter using the refresh share functionality.\n\n### References\n\nThank you [BlockSec](https://blocksec.com/) for reporting the finding","aliases":["CVE-2025-58359"],"modified":"2025-09-05T16:11:20Z","published":"2025-09-03T21:29:18Z","database_specific":{"github_reviewed_at":"2025-09-03T21:29:18Z","github_reviewed":true,"nvd_published_at":"2025-09-05T00:15:32Z","severity":"MODERATE","cwe_ids":["CWE-269","CWE-325"]},"references":[{"type":"WEB","url":"https://github.com/ZcashFoundation/frost/security/advisories/GHSA-wgq8-vr6r-mqxm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58359"},{"type":"WEB","url":"https://github.com/ZcashFoundation/frost/commit/379ef689c733b3d9c80fd409071d4f3af4dafed2"},{"type":"PACKAGE","url":"https://github.com/ZcashFoundation/frost"},{"type":"WEB","url":"https://github.com/ZcashFoundation/frost/releases/tag/frost-core%2Fv2.2.0"}],"affected":[{"package":{"name":"frost-core","ecosystem":"crates.io","purl":"pkg:cargo/frost-core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-wgq8-vr6r-mqxm/GHSA-wgq8-vr6r-mqxm.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}