Tss-lib vulnerabilities

2 known vulnerabilities in Tss-lib from Iofinnet. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Tss-lib: Observable Discrepancy

  CVE-2023-26557Apr 21, 2023Iofinnet

  io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/pa

• 9.1 Critical severity

  Tss-lib: Observable Discrepancy

  CVE-2023-26556Apr 21, 2023Iofinnet

  io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/key