Collision of hash values in github.com/bnb-chain/tss-lib

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-47931 · ADVISORY
• bnb-chain/tss-lib#233 · WEB
• IoFinnet/threshlib commit 369ec50 · WEB
• bnb-chain/tss-lib commit bb6fb30 · WEB
• IoFinnet/threshlib release v2.0.0 · WEB
• bnb-chain/tss-lib · PACKAGE
• golang/vulndb · WEB
• medium.com/@iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b · WEB
• IoFinnet/tss-lib commit 369ec50 · Patch
• IoFinnet/tss-lib release v2.0.0 · Release Notes
• medium.com/%40iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b

Altre vulnerabilità di github.com/binance-chain/tss-lib

• CVE-2023-26557ALTO 7.5io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, …
• CVE-2023-26556CRITICO 9.1io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication impleme…
• CVE-2022-47930MEDIO 6.8An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implemen…
• CVE-2020-12118ALTO 8.2The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to com…