Post-Quantum Cryptography Vulnerability in oqs-provider Affects TLS, X.509, and S/MIME

CVE-2024-37305

What is CVE-2024-37305?

The oqs-provider, a component of the OpenSSL 3 cryptography library that integrates post-quantum cryptographic support, contains a vulnerability related to improper handling of length values when decoding serialized hybrid keys and signatures. This flaw, identified in the DECODE_UINT32 function, allows for the exploitation of unchecked length values, potentially resulting in application crashes or leakage of sensitive information. Affected versions require immediate attention, with a patched release available in v0.6.1. Users are advised to upgrade promptly as no workarounds exist for this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References