Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Iofinnet Clear all filters
TI-2023-11694 CVE-2023-26557 · GHSA-mjqv-xhgm-gx8c

io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing…

Priority LOW 34

io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00864 Published 2023-04-21 Fixed in 1.3.6-0.20230324145555-bb6fb30bd3eb CWE-203
TI-2023-11693 CVE-2023-26556 · GHSA-3w84-4mjc-rjw7

io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack…

Priority MEDIUM 49

io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statem…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00864 Published 2023-04-21 Fixed in 2.0.0 CWE-203