GHSA-978j-88f3-p5j3 Threshold value is ignored (all shares are n=3)

Not scored Published 21 Jan 2020

A Rust library flaw forces a fixed threshold of three shares, ignoring configuration and weakening the security of secret sharing implementations.

What is GHSA-978j-88f3-p5j3?

GHSA-978j-88f3-p5j3 is a vulnerability in shamir, published on 21 Jan 2020.

Official description

Affected versions of this crate did not properly calculate secret shares requirements.

This reduces the security of the algorithm by restricting the crate to always using a threshold value of three, rather than a configurable limit.

The flaw was corrected by correctly configuring the threshold.

3 open source packages ship an affected version, including shamir.

Upgrade shamir to 2.0.0 or later.

There is no known exploitation of GHSA-978j-88f3-p5j3 in the wild and no public exploit code.

Also known as RUSTSEC-2020-0160.