Pdugre

**Name of the Vulnerable Software and Affected Versions** Devolutions.XTS.NET versions 2024.11.19 and earlier **Description** The issue concerns a non-constant time cryptographic operation, which can be exploited via timing attacks. This allows an attacker to render half of the encryption key obsolete. Successful exploitation downgrades the security guarantees of the XTS mode to those of ECB mode, enabling block swapping and identification of identical blocks. Timing attacks require specific conditions to be exploitable. **Recommendations** For versions 2024.11.19 and earlier, upgrade the package to version 2024.11.26 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Galois Field multiplications in the package until a patch is applied.