Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/bnb-chain/tss-lib

4 known vulnerabilities (1 critical, 1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 critical, 1 high, 2 medium
Registry
pkg.go.dev

Advisories 4

  • io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go…

    Affected: fixed in 1.3.6-0.20230324145555-bb6fb30bd3eb.

  • CVE-2023-26556Critical 9.1

    io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication…

    Affected: fixed in 1.3.6-0.20230324145555-bb6fb30bd3eb; fixed in 2.0.0.

  • CVE-2022-47930Medium 6.8

    An issue was discovered in IO FinNet tss-lib before 2.0.0.

    Affected: fixed in 2.0.0; all versions.

  • CVE-2022-47931Medium 6.5

    IO FinNet tss-lib before 2.0.0 allows a collision of hash values.

    Affected: fixed in 1.3.6-0.20230324145555-bb6fb30bd3eb.