CVE-2023-33241

Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signature...

Design/Logic Flaw

Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signature...

Design/Logic Flaw

Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt 256 in total because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed...

CVE-2023-33242 Lindell17 TSS Abort Mishandling

Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt 256 in total because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed...

CVE-2023-33242 Lindell17 TSS Abort Mishandling

Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt 256 in total because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed...

CVE-2023-33242

CVE-2023-33242 affects crypto wallets implementing Lindell17 TSS. The vulnerability arises from mishandling aborts after a failed signature, allowing an attacker to exfiltrate the full ECDSA private key by extracting one bit per signature attempt (256 total). Connected materials include a PoC/exp...

CVE-2023-33241 GG18 / GG20 TSS Beta Parameter Vulnerability

Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signature...

CVE-2023-33241

CVE-2023-33241 affects wallets using GG18/GG20 TSS (MPC) protocols. A malicious pallier key injected during the protocol and cheating in the range proof may allow an attacker to exfiltrate a full ECDSA private key (or other parties’ key shares), with the required effort potentially depending on B...

CVE-2023-33241 GG18 / GG20 TSS Beta Parameter Vulnerability

Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signature...

GG18 TSS and GG20 TSS Injection Vulnerabilities

tss-lib is an open source IO FinNet implementation of the multi-party t,n- threshold ECDSA Elliptic Curve Digital Signature Algorithm based on Gennaro and Goldfeder 20201 and EdDSA Edwards Curve Digital Signature Algorithm. A security vulnerability exists in the GG18 , GG20 TSS that stems from...

PT-2023-24237

Name of the Vulnerable Software and Affected Versions Crypto wallets implementing GG18 or GG20 TSS protocol affected versions not specified Description Crypto wallets using the GG18 or GG20 Threshold Signature Scheme TSS protocols are susceptible to an issue where an attacker can extract a full...

Important: python-ecdsa

Issue Overview: An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions or no exceptions at all, which could lead to a denial of service. CVE-2019-14853 A flaw was found in all python-ecdsa...

EulerOS 2.0 SP9 : dhcp (EulerOS-SA-2023-2610)

According to the versions of the dhcp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively...

Inaccurate implementation of ECDSA creates signature malleability

Lines of code Vulnerability details Impact The ecrecover function is an inherent cryptographic function within Solidity which enables the retrieval of the signer's address messages which have been signed with their private key. Of course, this is very important when it comes to verifying the...

Signature malleability not protected against

Lines of code Vulnerability details Impact A signature should never be included into a signed message hash to check if previously messages have been processed by the contract. See reference: Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any othe...

EulerOS Virtualization 3.0.6.6 : bind (EulerOS-SA-2023-2404)

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance,...

USN-6239-1: ECDSA Util vulnerability

It was discovered that ECDSA Util did not properly verify certain signature values. An attacker could possibly use this issue to bypass signature verification...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS : ECDSA Util vulnerability (USN-6239-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6239-1 advisory. It was discovered that ECDSA Util did not properly verify certain signature values. An attacker could possibly use this issue ...

ALSA-2023:3722 Moderate: openssl security and bug fix update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: Possible DoS translating ASN.1 object identifiers CVE-2023-2650 openssl: Denial of service by...

Power LED Side-Channel Attack

This is a clever new side-channel attack: The first attack uses an Internet-connected surveillance camera to take a high-speed video of the power LED on a smart card reader­--or of an attached peripheral device--­during cryptographic operations. This technique allowed the researchers to pull a...