Detections
Analytics

SCA: security update for github.com/consensys/gnark (GHSA-9xcg-3q8v-7fq6)

high Tenable Cloud Security Plugin ID 413549

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.11.0,
 commitments to private witnesses in Groth16 as implemented break the zero-knowledge property. The
 vulnerability affects only Groth16 proofs with commitments. Notably, PLONK proofs are not affected. The
 vulnerability affects the zero-knowledge property of the proofs - in case the witness (secret or internal)
 values are small, then the attacker may be able to enumerate all possible choices to deduce the actual
 value. If the possible choices for the variables to be committed is large or there are many values
 committed, then it would be computationally infeasible to enumerate all valid choices. It doesn't affect
 the completeness/soundness of the proofs. The vulnerability has been fixed in version 0.11.0. The patch to
 fix the issue is to add additional randomized value to the list of committed value at proving time to mask
 the rest of the values which were committed. As a workaround, the user can manually commit to a randomized
 value. (CVE-2024-45040)

See Also

https://github.com/advisories/GHSA-9xcg-3q8v-7fq6

Plugin Details

Severity: High

ID: 413549

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2024-45040

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.2

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/6/2024

Vulnerability Publication Date: 9/6/2024

Reference Information

CVE: CVE-2024-45040

cwe: CWE-200