Vulnerability Report: GO-2023-2003

• GHSA-8c37-7qx3-4c4p
• Affects: github.com/supranational/blst
• Published: Aug 10, 2023
• Modified: Dec 13, 2023

When complemented with a check for infinity, blst skips performing a signature group-check. Formally speaking, infinity is the identity element of the elliptic curve group and as such it is a member of the group, so the group-check should be performed. The fix performs the check even in the presence of infinity.