Iofinnet vulnerabilities
We track 2 vulnerabilities in Iofinnet products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 21, 2023.
2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score
Latest Iofinnet vulnerabilities
- 7.5 High severity
Tss-lib: Observable Discrepancy
io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/pa
- 9.1 Critical severity
Tss-lib: Observable Discrepancy
io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/key