PT-2020-10416 · Parity · Libsecp256K1-Rs

Published 2020-01-22 · Updated 2021-08-25 · CVE-2019-20399

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parity libsecp256k1-rs versions prior to 0.3.1

Description A timing vulnerability in the Scalar::check overflow function potentially allows an attacker to leak information via a side-channel attack.

Recommendations For versions prior to 0.3.1, update to version 0.3.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Scalar::check overflow function until a patch is available.

Fix

Race Condition

Side Channel Attack

Weakness Enumeration

CWE-362

CWE-203

Related Identifiers

CVE-2019-20399

GHSA-7CQG-8449-RMFV

RUSTSEC-2020-0156

Affected Products

Libsecp256K1-Rs

References · 8

• https://github.com/paritytech/libsecp256k1/commit/11ba23a9766a5079918cd9f515bc100bc8164b50 · Patch
• https://osv.dev/vulnerability/CVE-2019-20399 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7cqg-8449-rmfv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20399 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0156 · Vendor Advisory
• https://rustsec.org/advisories/RUSTSEC-2020-0156.html · Note
• https://crates.io/crates/libsecp256k1-rs · Note
• https://t.me/cvenotify/392 · Telegram Post