Is curve25519-dalek affected by CVE-2024-58262?

crates.io curve25519-dalek is affected in <4.1.3.

Is CVE-2024-58262 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.1%.

low

CVE-2024-58262

Q: Is CVE-2024-58262 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.1%.

crates.io · curve25519-dalek

Summary

curve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`

Severity: low
EPSS: 0.1% (p4)
Also known as: GHSA-x4gp-pqpj-f43q, RUSTSEC-2024-0344
Published: 2024-06-18

References

https://nvd.nist.gov/vuln/detail/CVE-2024-58262
https://github.com/dalek-cryptography/curve25519-dalek/pull/659
https://github.com/dalek-cryptography/curve25519-dalek/commit/415892acf1cdf9161bd6a4c99bc2f4cb8fae5e6a

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.