Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/binance-chain/tss-lib

5 known vulnerabilities (1 critical, 1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 critical, 1 high, 2 medium
Registry
pkg.go.dev

Advisories 5

  • io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go…

    Affected: fixed in 1.3.6-0.20230324145555-bb6fb30bd3eb; all versions.

  • CVE-2023-26556Critical 9.1

    io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication…

    Affected: all versions; fixed in 2.0.0.

  • CVE-2022-47930Medium 6.8

    An issue was discovered in IO FinNet tss-lib before 2.0.0.

    Affected: fixed in 2.0.0; all versions.

  • CVE-2022-47931Medium 6.5

    IO FinNet tss-lib before 2.0.0 allows a collision of hash values.

    Affected: all versions.

  • The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to…

    Affected: fixed in 1.2.0.