Eclipse Keypont
Monthly
ML-KEM key-pair lookups in Eclipse KeyPont crypto11 v2 (2.0.0-rc3 through 2.0.0-rc8) bind a public key to a private key without verifying that the two actually belong together, so Encapsulate() can encrypt a fresh shared secret to a public key whose owner is not the holder of the private key the caller looked up, letting that third party recover the secret. Two paths lead there: an attacker able to open a session on the same PKCS#11 token can plant a CKK_ML_KEM public object carrying the victim's CKA_ID/CKA_LABEL, or, when an ML-KEM private key has a label but no CKA_ID and no matching public object, an 'ID only' fallback search degrades to a class-and-type template and silently returns whichever ML-KEM public key the token lists first. The advisory documents a reproduction on SoftHSMv2 and SoftHSMv3; the issue is not listed in CISA KEV, the CVSS vector is local, low-privilege (AV:L/PR:L) with high confidentiality impact, and v1 module paths are unaffected because they have no ML-KEM support. Overall the risk is moderate and conditional: it requires a shared token, an application invoking the ML-KEM lookup and encapsulation path, and either a planting-capable session or a label-only key layout.
ML-KEM key-pair lookups in Eclipse KeyPont crypto11 v2 (2.0.0-rc3 through 2.0.0-rc8) bind a public key to a private key without verifying that the two actually belong together, so Encapsulate() can encrypt a fresh shared secret to a public key whose owner is not the holder of the private key the caller looked up, letting that third party recover the secret. Two paths lead there: an attacker able to open a session on the same PKCS#11 token can plant a CKK_ML_KEM public object carrying the victim's CKA_ID/CKA_LABEL, or, when an ML-KEM private key has a label but no CKA_ID and no matching public object, an 'ID only' fallback search degrades to a class-and-type template and silently returns whichever ML-KEM public key the token lists first. The advisory documents a reproduction on SoftHSMv2 and SoftHSMv3; the issue is not listed in CISA KEV, the CVSS vector is local, low-privilege (AV:L/PR:L) with high confidentiality impact, and v1 module paths are unaffected because they have no ML-KEM support. Overall the risk is moderate and conditional: it requires a shared token, an application invoking the ML-KEM lookup and encapsulation path, and either a planting-capable session or a label-only key layout.