Collision of hash values in github.com/bnb-chain/tss-lib

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-47931 · ADVISORY
• bnb-chain/tss-lib#233 · WEB
• IoFinnet/threshlib commit 369ec50 · WEB
• bnb-chain/tss-lib commit bb6fb30 · WEB
• IoFinnet/threshlib release v2.0.0 · WEB
• bnb-chain/tss-lib · PACKAGE
• golang/vulndb · WEB
• medium.com/@iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b · WEB
• IoFinnet/tss-lib commit 369ec50 · Patch
• IoFinnet/tss-lib release v2.0.0 · Release Notes
• medium.com/%40iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b

github.com/binance-chain/tss-lib のその他の脆弱性

• CVE-2023-26557高 7.5io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, …
• CVE-2023-26556緊急 9.1io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication impleme…
• CVE-2022-47930中 6.8An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implemen…
• CVE-2020-12118高 8.2The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to com…