CloudflareGHSA-9763-4f94-gfch
Kyber: timing side-channel (kyberslash2)
HighPublished Jan 8, 2024
### Impact On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key. Does not apply to ephemeral usage, such as when used in the regular way in TLS. ### Patches Patched in 1.3.7. ### References - [kyberslash.cr.yp.to](https://kyberslash.cr.yp.to/)
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/cloudflare/circl Go | < 1.3.7 | 1.3.7 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More Cloudflare advisories
All Cloudflare| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 292024 | Information disclosure of Cloudflare API for low privileged users | High8.1 | 4.12.3 |
| Dec 292023 | Arbitrary remote code execution within `wrangler dev` Workers sandbox | High8.5 | 3.19.0+1 more |
| Dec 292023 | Arbitrary remote file read in Wrangler dev server | Medium6.9 | 3.19.0 |
| Dec 292023 | Server-Side Request Forgery (SSRF) in Miniflare | High8.0 | 3.20231030.2 |
| Dec 122023 | Unbounded queuing of path validation messages in cloudflare-quiche | Medium5.3 | 0.19.1 |
| Dec 52023 | Resource exhaustion via memory leak in tokio-boring | Medium5.3 | 4.1.0 |