CVE-2023-44273 Duplicate Advisory: Consensys gnark-crypto allows Signature Malleability

What is CVE-2023-44273?

CVE-2023-44273 is a critical unsafe deserialization vulnerability in n/a, published on 28 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.

Weakness: CWE-502

Which versions are affected by CVE-2023-44273?

8 open source packages ship an affected version, including github.com/consensys/gnark-crypto and github.com/Consensys/gnark-crypto. It affects 1 product.

Products include Consensys Gnark-Crypto.

How do I fix CVE-2023-44273?

Upgrade github.com/consensys/gnark-crypto to 0.12.0 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2023-44273 being exploited?

There is no known exploitation of CVE-2023-44273 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-45039 gnark's Groth16 commitment extension unsound for more than one commitment Medium 6.2
• CVE-2024-45040 gnark's commitments to private witnesses in Groth16 as implemented break zero-knowledge property Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-9xfq-8j3r-xp5g, GHSA-fr8m-434r-g3xp, GO-2023-2096, GO-2025-4027.