{"id":"GO-2023-2003","summary":"Group signature validation bypass in github.com/supranational/blst","details":"When complemented with a check for infinity, blst skips performing a signature group-check. Formally speaking, infinity is the identity element of the elliptic curve group and as such it is a member of the group, so the group-check should be performed. The fix performs the check even in the presence of infinity.","aliases":["GHSA-8c37-7qx3-4c4p"],"modified":"2024-05-20T16:03:47Z","published":"2023-08-10T22:06:06Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2023-2003","review_status":"REVIEWED"},"references":[{"type":"FIX","url":"https://github.com/supranational/blst/commit/fb91221c91c82f65bfc7f243256308977a06d48b"},{"type":"WEB","url":"https://github.com/supranational/blst/releases/tag/v0.3.11"}],"affected":[{"package":{"name":"github.com/supranational/blst","ecosystem":"Go","purl":"pkg:golang/github.com/supranational/blst"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.11"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/supranational/blst/bindings/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2023-2003.json"}}],"schema_version":"1.7.3","credits":[{"name":"Yunjong Jeong (@blukat29)"}]}