Incorrect Default Permissions in Binance tss-lib

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-12118 · ADVISORY
• binance-chain/tss-lib#89 · WEB
• binance-chain/tss-lib#89 · WEB
• binance-chain/tss-lib release v1.2.0 · WEB
• GitHub Advisory GHSA-399h-cmvp-qgx5 · ADVISORY

github.com/binance-chain/tss-lib のその他の脆弱性

• CVE-2023-26557高 7.5io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, …
• CVE-2023-26556緊急 9.1io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication impleme…
• CVE-2022-47930中 6.8An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implemen…
• CVE-2022-47931緊急 9.1IO FinNet tss-lib before 2.0.0 allows a collision of hash values.