Vulnerability Report: GO-2023-2098

Affected Packages

• Path
  Versions
  Symbols
• github.com/consensys/gnark/frontend/cs/r1cs
  before v0.9.0
  5 unexported affected symbols

  • builder.AssertIsLessOrEqual
  • builder.Cmp
  • builder.ToBinary
  • builder.mustBeLessOrEqCst
  • builder.mustBeLessOrEqVar
• github.com/consensys/gnark/frontend/cs/scs
  before v0.9.0
  5 unexported affected symbols

  • builder.AssertIsLessOrEqual
  • builder.Cmp
  • builder.ToBinary
  • builder.mustBeLessOrEqCst
  • builder.mustBeLessOrEqVar
• github.com/consensys/gnark/internal/backend/circuits
  before v0.9.0
  1 unexported affected symbols

  • recursiveHint.Define
• github.com/consensys/gnark/std/math/bits
  before v0.9.0
  • WithNbDigits

Aliases

• CVE-2023-44378
• GHSA-498w-5j49-vqjg

References

• https://github.com/zkopru-network/zkopru/issues/116
• https://github.com/Consensys/gnark/pull/835
• https://github.com/Consensys/gnark/commit/59a4087261a6c73f13e80d695c17b398c3d0934f
• https://github.com/advisories/GHSA-498w-5j49-vqjg
• https://vuln.go.dev/ID/GO-2023-2098.json

Credits

• @kustosz

Feedback