Public Key Signing Vulnerability in ed25519-dalek Library by Rust

CVE-2022-50237

What is CVE-2022-50237?

The ed25519-dalek crate prior to version 2 exhibits a vulnerability in its Keypair implementation, allowing attackers to perform a double public key signing function oracle attack. This flaw enables malicious actors to execute a straightforward computation process to extract a private key, potentially compromising sensitive data and cryptographic integrity. Users are advised to update to the latest version to mitigate this risk.

References