x/vulndb: potential Go vuln in github.com/Consensys/gnark: CVE-2024-50354

[GoVulnBot]

Advisory CVE-2024-50354 references a vulnerability in the following Go modules:

Module
github.com/Consensys/gnark

Description:
gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-50354
• FIX: Consensys/gnark@47ae846
• FIX: fix: sanitize groth16 verification key reading Consensys/gnark#1307
• WEB: GHSA-cph5-3pgr-c82g

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/Consensys/gnark
      vulnerable_at: 0.11.0
summary: CVE-2024-50354 in github.com/Consensys/gnark
cves:
    - CVE-2024-50354
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-50354
    - fix: https://github.com/Consensys/gnark/commit/47ae846339add2bdf9983e499342bfdfe195191d
    - fix: https://github.com/Consensys/gnark/pull/1307
    - web: https://github.com/Consensys/gnark/security/advisories/GHSA-cph5-3pgr-c82g
source:
    id: CVE-2024-50354
    created: 2024-10-31T17:01:23.093953083Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/624497 mentions this issue: data/reports: add GO-2024-3244

[gopherbot]

Change https://go.dev/cl/647275 mentions this issue: data/reports: update GO-2024-3244