git: d978569358a7 - main - security/vuxml: Fix validate errors in pycryptodome entry
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 14 Oct 2026 06:36:56 UTC
The branch main has been updated by brnrd:
URL: https://cgit.FreeBSD.org/ports/commit/?id=d978569358a7a7b4fe237495f9888a67f5e5dfa7
commit d978569358a7a7b4fe237495f9888a67f5e5dfa7
Author: Bernard Spil <brnrd@FreeBSD.org>
AuthorDate: 2026-10-14 06:36:16 +0000
Commit: Bernard Spil <brnrd@FreeBSD.org>
CommitDate: 2026-10-14 06:36:39 +0000
security/vuxml: Fix validate errors in pycryptodome entry
---
security/vuxml/vuln/2026.xml | 63 ++++++++++++++++++++++----------------------
1 file changed, 31 insertions(+), 32 deletions(-)
diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml
index 380b001a4970..4ae4012319c1 100644
--- a/security/vuxml/vuln/2026.xml
+++ b/security/vuxml/vuln/2026.xml
@@ -122,45 +122,44 @@
<topic>Timing leaks of the nonce in ECDSA, EdDSA and DSA signatures</topic>
<affects>
<package>
- <name>py312-pycryptodome</name>
- <name>py312-pycryptodomex</name>
- <name>py313-pycryptodome</name>
- <name>py313-pycryptodomex</name>
- <name>py313t-pycryptodome</name>
- <name>py313t-pycryptodomex</name>
- <name>py314-pycryptodome</name>
- <name>py314-pycryptodomex</name>
- <name>py314t-pycryptodome</name>
- <name>py314t-pycryptodomex</name>
- <name>py311-pycryptodome</name>
- <name>py311-pycryptodomex</name>
- <name>py315-pycryptodome</name>
- <name>py315-pycryptodomex</name>
- <name>py27-pycryptodome</name>
- <name>py27-pycryptodomex</name>
- <range>
- <lt>3.24.1</lt>
- </range>
+ <name>py312-pycryptodome</name>
+ <name>py312-pycryptodomex</name>
+ <name>py313-pycryptodome</name>
+ <name>py313-pycryptodomex</name>
+ <name>py313t-pycryptodome</name>
+ <name>py313t-pycryptodomex</name>
+ <name>py314-pycryptodome</name>
+ <name>py314-pycryptodomex</name>
+ <name>py314t-pycryptodome</name>
+ <name>py314t-pycryptodomex</name>
+ <name>py311-pycryptodome</name>
+ <name>py311-pycryptodomex</name>
+ <name>py315-pycryptodome</name>
+ <name>py315-pycryptodomex</name>
+ <name>py27-pycryptodome</name>
+ <name>py27-pycryptodomex</name>
+ <range><lt>3.24.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Helder Eijs reports</p>
- <blockquote cite="://github.com/Legrandin/pycryptodome/commit/59351474682db6648825f17b11112d6821d66cb9">
- <p>Fix timing leaks of the nonce in ECDSA, EdDSA and DSA signatures
- The signing time depended on the secret nonce, enough to recover the
- private key with a lattice attack.
-
- - EC: scalars are encoded and processed on the full length of the
- order, and ec_mix_add() is constant time for the point at infinity
- (a zero digit).
- - DSA: g^k uses k + q or k + 2q (fixed length) and mpz_powm_sec, or the
- library's Montgomery exponentiation without GMP. About 40% slower.</p>
- </blockquote>
+ <p>Helder Eijs reports</p>
+ <blockquote cite="https://github.com/Legrandin/pycryptodome/commit/59351474682db6648825f17b11112d6821d66cb9">
+ <p>Fix timing leaks of the nonce in ECDSA, EdDSA and DSA signatures
+ The signing time depended on the secret nonce, enough to recover the
+ private key with a lattice attack.
+
+ - EC: scalars are encoded and processed on the full length of the
+ order, and ec_mix_add() is constant time for the point at infinity
+ (a zero digit).
+ - DSA: g^k uses k + q or k + 2q (fixed length) and mpz_powm_sec, or the
+ library's Montgomery exponentiation without GMP. About 40% slower.</p>
+ </blockquote>
</body>
</description>
<references>
- </references>
+ <url>https://github.com/Legrandin/pycryptodome/commit/59351474682db6648825f17b11112d6821d66cb9</url>
+ </references>
<dates>
<discovery>2026-10-11</discovery>
<entry>2026-10-12</entry>