Post-Quantum Cryptography Vulnerability in oqs-provider Affects TLS, X.509, and S/MIME

CVE-2024-37305

What is CVE-2024-37305?

The oqs-provider, a component of the OpenSSL 3 cryptography library that integrates post-quantum cryptographic support, contains a vulnerability related to improper handling of length values when decoding serialized hybrid keys and signatures. This flaw, identified in the DECODE_UINT32 function, allows for the exploitation of unchecked length values, potentially resulting in application crashes or leakage of sensitive information. Affected versions require immediate attention, with a patched release available in v0.6.1. Users are advised to upgrade promptly as no workarounds exist for this issue.

References