5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-g693-v3jr-8hcr

GHSA-g693-v3jr-8hcr: Duplicate Advisory: `ed25519-dalek` Double Public Key Signing Function Oracle Attack

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-w5vr-6qhr-36cc. This link is maintained to preserve external references.

Original Description

The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-g693-v3jr-8hcr

GHSA-g693-v3jr-8hcr:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ed25519-dalek	rust	< 2.0.0	2.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, a double public key signing function oracle attack, stems from the ability to sign a message using a secret key while providing an arbitrary, non-matching public key. This allows an attacker to create two signatures for the same message with the same R value but different S values, from which the private key can be calculated.

The root cause lies in the ed25519_dalek::secret::ExpandedSecretKey::sign and sign_prehashed functions, which were part of the public API and accepted a PublicKey as a parameter, without verifying its correspondence to the ExpandedSecretKey.

This vulnerability could be triggered in two ways:

Directly calling the public ExpandedSecretKey::sign or sign_prehashed methods.
Indirectly by first creating a Keypair with a mismatched public key and then calling the Keypair::sign method. The creation of a malicious Keypair was possible because its fields were public, and the Keypair::from_bytes constructor did not validate the key correspondence.

The patch addresses these issues comprehensively:

It makes the ExpandedSecretKey struct and its signing methods pub(crate), removing them from the public API and preventing direct misuse.
It makes the fields of the Keypair struct pub(crate), preventing manual instantiation with mismatched keys.
It adds a validation step in Keypair::from_bytes to ensure the public key is correctly derived from the secret key.

By enforcing the invariant that a Keypair's public key must be derived from its secret key, the Keypair::sign function is no longer an attack vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.