Add CVSS 3.1 severity for GHSA-x4gp-pqpj-f43q

[sunnypatell]

Changes

Added CVSS 3.1 scoring to GHSA-x4gp-pqpj-f43q (curve25519-dalek timing variability in scalar subtraction).

• Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (5.1 Medium)

CVSS justification

• AV:L - timing side-channel requires local access to observe execution timing differences
• AC:H - exploiting timing variability in Scalar29::sub/Scalar52::sub requires precise measurement and statistical analysis
• C:H - successful exploitation could leak secret scalar values used in cryptographic operations
• I:N/A:N - this is a read-only information leak; no data modification or service disruption

References

• NVD: CVE-2024-58262
• Fix PR
• RUSTSEC-2024-0344

[Copilot]

Pull request overview

This pull request adds CVSS 3.1 scoring information to the GitHub Security Advisory GHSA-x4gp-pqpj-f43q, which documents a timing variability vulnerability in the curve25519-dalek cryptographic library. The vulnerability affects the Scalar29::sub and Scalar52::sub functions and could potentially leak secret scalar values through timing side-channel attacks.

Changes:

• Adds CVSS 3.1 vector string and scoring to the security advisory JSON file
• Provides detailed justification for each CVSS metric based on the vulnerability characteristics

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sunnypatell]

corrected the CVSS vector to use the CNA-sourced score (cve@mitre.org) instead of the NVD primary score.

• was: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (5.1, nvd@nist.gov)
• now: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N (2.9, cve@mitre.org)

[shelbyc]

Hi @sunnypatell, I'm merging this PR because GHSA-x4gp-pqpj-f43q doesn't already have a CVSS attached to the advisory and a CVSS would be appropriate for the severity of the issue described in the GHSA. I agree with the choice of MITRE's CVSS CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

[advisory-database]

Hi @sunnypatell! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!