https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:36:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-252073 EUVD-2026-252073 https://cve.radiocsirt.org/vuln/euvd-2026-252073 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58359 <p>ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 through 2.1.0, refresh shares with smaller min_signers will reduce security of group. The inability to change min_signers (i.e. the threshold) with the refresh share functionality (frost_core::keys::refresh module) was not made clear to users. Using a smaller value would not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after refreshing the shares with a smaller threshold, it would still be possible to sign with the original threshold, potentially causing a security loss to the participant&#39;s shares. This issue is fixed in version 2.2.0.</p> <p>ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 through 2.1.0, refresh shares with smaller min_signers will reduce security of group. The inability to change min_signers (i.e. the threshold) with the refresh share functionality (frost_core::keys::refresh module) was not made clear to users. Using a smaller value would not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after refreshing the shares with a smaller threshold, it would still be possible to sign with the original threshold, potentially causing a security loss to the participant&#39;s shares. This issue is fixed in version 2.2.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-58359 https://cve.radiocsirt.org/vuln/ghsa-wgq8-vr6r-mqxm <p><strong>Affected:</strong> crates.io: frost-core</p> <p>### Impact</p> <p>It was not clear that it is not possible to change `min_signers` (i.e. the threshold) with the refresh share functionality (`frost_core::keys::refresh` module). Using a smaller value would not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after refreshing the shares with a smaller threshold, it would still be possible to sign with the original threshold; however, this could cause a security loss to the participant&#39;s shares. We have not determined the exact security implications of doing so and judged simpler to just validate `min_signers`.</p> <p>If for some reason you have done a refresh share procedure with a smaller `min_signers` we strongly recommend migrating to a new key.</p> <p>### Patches</p> <p>Updating to 2.2.0 will ensure that the `min_signers` parameter will be validated. However it won&#39;t restore the security of groups refreshed with a smaller `min_signers` parameters.</p> <p>### Workarounds</p> <p>You don&#39;t need to update if you don&#39;t use the refresh share functionality, or if you didn&#39;t try to change the `min_signers` parameter using the refresh share functionality.</p> <p>### References</p> <p>Thank you [BlockSec](https://blocksec.com/) for reporting the finding</p> <p><strong>Affected:</strong> crates.io: frost-core</p> <p>### Impact</p> <p>It was not clear that it is not possible to change `min_signers` (i.e. the threshold) with the refresh share functionality (`frost_core::keys::refresh` module). Using a smaller value would not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after refreshing the shares with a smaller threshold, it would still be possible to sign with the original threshold; however, this could cause a security loss to the participant&#39;s shares. We have not determined the exact security implications of doing so and judged simpler to just validate `min_signers`.</p> <p>If for some reason you have done a refresh share procedure with a smaller `min_signers` we strongly recommend migrating to a new key.</p> <p>### Patches</p> <p>Updating to 2.2.0 will ensure that the `min_signers` parameter will be validated. However it won&#39;t restore the security of groups refreshed with a smaller `min_signers` parameters.</p> <p>### Workarounds</p> <p>You don&#39;t need to update if you don&#39;t use the refresh share functionality, or if you didn&#39;t try to change the `min_signers` parameter using the refresh share functionality.</p> <p>### References</p> <p>Thank you [BlockSec](https://blocksec.com/) for reporting the finding</p> https://cve.radiocsirt.org/vuln/ghsa-wgq8-vr6r-mqxm