PT-2019-12036 · Unknown · Elliptic-Php

Sam Sanoop · Publicado 2019-11-18 · Atualizado 2020-08-24 · CVE-2019-10764

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions elliptic-php versions prior to 1.0.6

Description The issue allows for potential timing attacks, which under certain conditions, could lead to the practical recovery of the long-term private key generated by the library. This is due to the possible leakage of a bit-length of the scalar during scalar multiplication on an elliptic curve.

Recommendations For versions prior to 1.0.6, update to version 1.0.6 or later to resolve the issue.

Exploit

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

Identificadores relacionados

CVE-2019-10764

GHSA-MR6R-82X4-F4JJ

SNYK-PHP-SIMPLITOELLIPTICPHP-534576

Produtos afetados

Elliptic-Php

Referências · 6

• 🔥 https://minerva.crocs.fi.muni.cz · Exploit
• https://github.com/simplito/elliptic-php/commit/15652609aa55968d56685c2a9120535ccdc00fd9 · Nota
• https://osv.dev/vulnerability/CVE-2019-10764 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10764 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mr6r-82x4-f4jj · Aviso do Fabricante
• https://snyk.io/vuln/SNYK-PHP-SIMPLITOELLIPTICPHP-534576 · Nota