GO-2023-2003

Dashboard / Vulnerabilities / GO-2023-2003

GO-2023-2003

Summary: Group signature validation bypass in github.com/supranational/blst

Details: When complemented with a check for infinity, blst skips performing a signature group-check. Formally speaking, infinity is the identity element of the elliptic curve group and as such it is a member of the group, so the group-check should be performed. The fix performs the check even in the presence of infinity.

References: https://github.com/supranational/blst/commit/fb91221c91c82f65bfc7f243256308977a06d48b, https://github.com/supranational/blst/releases/tag/v0.3.11