PT-2023-20726 · Unknown · Bnb-Chain/Tss-Lib+2

Published

2023-04-21

·

Updated

2023-07-11

·

CVE-2023-26557

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions io.finnet tss-lib versions prior to 2.0.0 bnb-chain/tss-lib versions prior to 2.0.0 thorchain/tss versions prior to 2.0.0
Description The issue is related to a timing side-channel attack that can leak the lambda value of a private key. This occurs because the software relies on Go big.Int, which is not constant time for certain operations like Cmp, modular exponentiation, or modular inverse. An example of this leak can be found in crypto/paillier/paillier.go.
Recommendations For io.finnet tss-lib versions prior to 2.0.0, update to version 2.0.0 or later. For bnb-chain/tss-lib versions prior to 2.0.0, update to version 2.0.0 or later. For thorchain/tss versions prior to 2.0.0, update to version 2.0.0 or later.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2023-26557
GHSA-MJQV-XHGM-GX8C
GO-2023-1733

Affected Products

Bnb-Chain/Tss-Lib
Io.Finnet Tss-Lib
Thorchain/Tss