https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 21:44:22 +0000 https://db.gcve.eu/vuln/rustsec-2023-0079 <p><strong>Affected:</strong> crates.io: pqc_kyber</p> <p>Various Kyber software libraries in various environments leak secret information into timing, specifically because</p> <p>* these libraries include a line of code that divides a secret numerator by a public denominator, * the number of CPU cycles for division in various environments varies depending on the inputs to the division, and * this variation appears within the range of numerators used in these libraries.</p> <p>The KyberSlash pages track which Kyber [libraries](https://kyberslash.cr.yp.to/libraries.html) have this issue, and include a [FAQ](https://kyberslash.cr.yp.to/faq.html) about the issue.</p> <p>## Author</p> <p>The KyberSlash pages were written by Daniel J. Bernstein. The FAQ originally said &#34;I&#34;, but some people seemed to have trouble finding this authorship statement, so the FAQ now says &#34;Bernstein&#34; instead.</p> <p>## URL</p> <p>The permanent link for the KyberSlash pages is [https://kyberslash.cr.yp.to](https://kyberslash.cr.yp.to).</p> <p>## Mitigation status in `pqc_kyber` crate</p> <p>The issue has not been resolved in the upstream `pqc_kyber` crate.</p> <p>A third-party fork that mitigates this attack vector has been published as [`safe_pqc_kyber`](https://crates.io/crates/safe_pqc_kyber).</p> <p>## Alternatives</p> <p>The [`ml-kem`](https://crates.io/crates/ml-kem) crate is a maintained alternative pure Rust implementation of ML-KEM / Kyber.</p> <p><strong>Affected:</strong> crates.io: pqc_kyber</p> <p>Various Kyber software libraries in various environments leak secret information into timing, specifically because</p> <p>* these libraries include a line of code that divides a secret numerator by a public denominator, * the number of CPU cycles for division in various environments varies depending on the inputs to the division, and * this variation appears within the range of numerators used in these libraries.</p> <p>The KyberSlash pages track which Kyber [libraries](https://kyberslash.cr.yp.to/libraries.html) have this issue, and include a [FAQ](https://kyberslash.cr.yp.to/faq.html) about the issue.</p> <p>## Author</p> <p>The KyberSlash pages were written by Daniel J. Bernstein. The FAQ originally said &#34;I&#34;, but some people seemed to have trouble finding this authorship statement, so the FAQ now says &#34;Bernstein&#34; instead.</p> <p>## URL</p> <p>The permanent link for the KyberSlash pages is [https://kyberslash.cr.yp.to](https://kyberslash.cr.yp.to).</p> <p>## Mitigation status in `pqc_kyber` crate</p> <p>The issue has not been resolved in the upstream `pqc_kyber` crate.</p> <p>A third-party fork that mitigates this attack vector has been published as [`safe_pqc_kyber`](https://crates.io/crates/safe_pqc_kyber).</p> <p>## Alternatives</p> <p>The [`ml-kem`](https://crates.io/crates/ml-kem) crate is a maintained alternative pure Rust implementation of ML-KEM / Kyber.</p> https://db.gcve.eu/vuln/rustsec-2023-0079