CVE-2022-29566

· HIGHModified

← All CVEs

CVSS v3.1

8.1

EPSS

0.72%

Published

Apr 21, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values from the Zero Knowledge proof statement as well as all of the public values computed in the proof, aka the Frozen Heart issue.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-326

Affected Products (1)

bulletproofs_project · bulletproofsvulnerable

References (4)

https://blog.trailofbits.com/2022/04/13/part-1-coordinated-disclosure-of-vulnerabilities-affecting-girault-bulletproofs-and-plonk/

ExploitThird Party Advisory

https://eprint.iacr.org/2017/1066

ProductTechnical DescriptionThird Party Advisory

https://blog.trailofbits.com/2022/04/13/part-1-coordinated-disclosure-of-vulnerabilities-affecting-girault-bulletproofs-and-plonk/

ExploitThird Party Advisory

https://eprint.iacr.org/2017/1066

ProductTechnical DescriptionThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs