5.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-29779

CVE-2025-29779: Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`

Description:

The secure_redundant_execution function in feldman_vss.py attempts to mitigate fault injection attacks by executing a function multiple times and comparing results. However, several critical weaknesses exist:

Python's execution environment cannot guarantee true isolation between redundant executions
The constant-time comparison implementation in Python is subject to timing variations
The randomized execution order and timing provide insufficient protection against sophisticated fault attacks
The error handling may leak timing information about partial execution results

These limitations make the protection ineffective against targeted fault injection attacks, especially from attackers with physical access to the hardware.

Impact:

A successful fault injection attack could allow an attacker to:

Bypass the redundancy check mechanisms
Extract secret polynomial coefficients during share generation or verification
Force the acceptance of invalid shares during verification
Manipulate the commitment verification process to accept fraudulent commitments

This undermines the core security guarantees of the Verifiable Secret Sharing scheme.

References:

File: feldman_vss.py
Function: secure_redundant_execution
Fault Attacks - Wikipedia article on fault attacks.
Bar-El, H., et al. "The Sorcerer's Apprentice Guide to Fault Attacks" - https://eprint.iacr.org/2004/100.pdf
CWE-1279: https://cwe.mitre.org/data/definitions/1279.html
NIST SP 800-90B section on implementation validation

Remediation:

Long-term remediation requires reimplementing the security-critical functions in a lower-level language like Rust.

Miggo Vulnerability Database

→

CVE-2025-29779

CVE-2025-29779:

5.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
PostQuantum-Feldman-VSS	pip	<= 0.8.0b2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability documentation explicitly identifies 'secure_redundant_execution' in feldman_vss.py as the vulnerable component. All provided sources (GitHub advisory, CVE description, NVD entry) consistently reference this function's implementation flaws related to fault injection countermeasures. The described weaknesses (lack of isolation, timing issues, insufficient randomization) are directly tied to this function's design and Python's inherent limitations. No other functions are mentioned in the vulnerability context.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.