PT-2022-28091 · Tss-Lib · Tss-Lib

Published 2022-12-22 · Updated 2023-08-08 · CVE-2022-47931

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions tss-lib versions prior to 2.0.0

Description The issue concerns a collision of hash values. This collision can potentially lead to security issues, although specific details about exploitation or affected devices are not provided.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue. As a temporary workaround, consider implementing additional hash value validation to minimize the risk of collision exploitation.

Fix

Use of a Broken Cryptographic Algorithm

Inadequate Encryption Strength

Weakness Enumeration

CWE-327

CWE-326

Related Identifiers

CVE-2022-47931

GHSA-CVCX-G7WH-X8RF

GO-2023-1904

Affected Products

Tss-Lib

References · 16

• https://osv.dev/vulnerability/GO-2023-1904 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cvcx-g7wh-x8rf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47931 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47931 · Vendor Advisory
• ❌ https://github.com/IoFinnet/tss-lib/commit/369ec50be1437588a9733443bcb2f15b794601d4 · Patch, Deleted
• https://github.com/bnb-chain/tss-lib · Note
• https://github.com/bnb-chain/tss-lib/commit/bb6fb30bd3ebd35c755109836aa1a5ee6126c8a0 · Note
• https://github.com/bnb-chain/tss-lib/pull/233 · Note
• https://github.com/golang/vulndb/blob/master/data/reports/GO-2023-1904.yaml · Note
• https://github.com/IoFinnet/threshlib/releases/tag/v2.0.0 · Note
• https://github.com/IoFinnet/threshlib/commit/369ec50be1437588a9733443bcb2f15b794601d4 · Note
• ❌ https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0 · Note, Deleted
• https://medium.com/%40iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b · Note
• https://t.me/cvenotify/40472 · Telegram Post
• https://medium.com/@iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b · Note