PT-2024-25510 · Phpecc+1 · Phpecc+2

Published 2024-04-27 · Updated 2024-11-04 · CVE-2024-33851

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions phpecc versions prior to 2.0.1 paragonie/ecc versions prior to 2.0.1 mdanter/ecc all versions

Description The issue is a branch-based timing leak in Point addition. This leak is related to the phpecc/phpecc library on GitHub and the Matyas Danter ECC library. The upstream code is no longer maintained, which means it remains vulnerable for all versions.

Recommendations For phpecc versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. For paragonie/ecc versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. For mdanter/ecc, since all versions are affected and no fix is available, consider using an alternative library until a fix is released. As a temporary workaround, consider restricting the use of the Point addition function to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2024-33851

GHSA-3494-CFWF-56HW

Affected Products

Mdanter/Ecc

Paragonie/Ecc

Phpecc

References · 8

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/mdanter/ecc/CVE-2024-33851.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-3494-cfwf-56hw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33851 · Security Note
• https://osv.dev/vulnerability/CVE-2024-33851 · Vendor Advisory
• https://github.com/phpecc/phpecc/issues/289 · Note
• https://github.com/paragonie/phpecc/releases/tag/v2.0.1 · Note
• https://github.com/paragonie/phpecc/releases/tag/v2.0.0 · Note
• https://t.me/cvenotify/78255 · Telegram Post