tss-lib 安全漏洞

tss-lib is an open source IO FinNet implementation of the multi-party t,n- threshold ECDSA Elliptic Curve Digital Signature Algorithm based on Gennaro and Goldfeder 2020 1 and EdDSA Edwards Curve Digital Signature Algorithm. A security vulnerability exists in IO FinNet tss-lib versions prior to...

CVE-2023-26556

io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time there is an if statement in a loop. One leak is in ecdsa/keygen/round2.go. bnb-chain/tss-lib and...

PT-2023-20725 · Unknown · Thorchain/Tss +3

Name of the Vulnerable Software and Affected Versions: io.finnet tss-lib versions prior to 2.0.0 bnb-chain/tss-lib versions prior to 2.0.0 thorchain/tss versions prior to 2.0.0 Description: The issue is related to a timing side-channel attack that can leak a secret key. This occurs because the...

Observable Discrepancy

io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time there is an if statement in a loop. One leak is in ecdsa/keygen/round2.go. bnb-chain/tss-lib and...

PT-2023-15533 · Tss-Lib +1 · Tss-Lib +1

Name of the Vulnerable Software and Affected Versions: tss-lib versions prior to 2.0.0 Description: An issue was discovered in the tss-lib library, where the parameter ssid for defining a session id is not used through the MPC implementation. This makes replaying and spoofing of messages easier, ...

CVE-2023-26556

io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time there is an if statement in a loop. One leak is in ecdsa/keygen/round2.go. bnb-chain/tss-lib and...

CVE-2023-26556

CVE-2023-26556 affects io.finnet tss-lib prior to 2.0.0. The vulnerability arises from a timing side-channel leak in the scalar-multiplication code path used by ECDSA key generation, relying on Go’s crypto/elliptic implementation which is not constant time. Affected code path is identified in ecd...

CVE-2023-26557

io.finnet tss-lib before 2.0.0 is vulnerable to a timing side-channel that can leak the lambda value of a private key because it uses Go big.Int in non-constant-time operations (Cmp, modular exponentiation, modular inverse). The issue affects tss-lib versions prior to 2.0.0 and is noted for bnb-c...

PT-2023-20726 · Unknown · Thorchain/Tss +2

Name of the Vulnerable Software and Affected Versions: io.finnet tss-lib versions prior to 2.0.0 bnb-chain/tss-lib versions prior to 2.0.0 thorchain/tss versions prior to 2.0.0 Description: The issue is related to a timing side-channel attack that can leak the lambda value of a private key. This...

CVE-2022-47930

An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session...

CBL Mariner 2.0 Security Update: openvswitch (CVE-2019-25076)

The version of openvswitch installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-25076 advisory. - The TSS Tuple Space Search algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attacke...

Mageia: Security Advisory (MGASA-2023-0050)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Low: tpm2-tss

Issue Overview: tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Stack TSS2. In affected versions Tss2RCSetHandler and Tss2RCDecode both index into layerhandler with an 8 bit layer number, but the array only has...

Amazon Linux 2023 : tpm2-tss, tpm2-tss-devel (ALAS2023-2023-110)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-110 advisory. tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Stack TSS2. In affected versions Tss2RCSetHandler and Tss2RCDecode both index...

Hackers threaten to leak STALKER 2 assets if devs don’t heed demands

Ukrainian game developer GSC Game World has announced it was breached by Russian hacktivists who stole assets related to the much-awaited game STALKER 2: Heart of Chernobyl. A message from GSC Game World team pic.twitter.com/rqRM0tFZmO -- S.T.A.L.K.E.R. OFFICIAL @stalkerthegame March 12, 2023...

SUSE-SU-2023:0613-1 Security update for tpm2-0-tss

This update for tpm2-0-tss fixes the following issues: - CVE-2023-22745: Fixed a memory safety issue that could be exploited by local attackers with TPM access bsc1207325...

SUSE SLED15: libtss2-esys0 / libtss2-esys0-32bit / libtss2-fapi1 / etc (SUSE-SU-2023:0526-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0526-1 advisory. - CVE-2023-22745: Fixed a memory safety issue that could be exploited by local attackers with TPM access...

SUSE-SU-2023:0526-1 Security update for tpm2-0-tss

This update for tpm2-0-tss fixes the following issues: - CVE-2023-22745: Fixed a memory safety issue that could be exploited by local attackers with TPM access bsc1207325...

CVE-2023-22745 affecting package tpm2-tss for versions less than 2.4.6-2

CVE-2023-22745 affecting package tpm2-tss for versions less than 2.4.6-2. A patched version of the package is available...

[SECURITY] Fedora 36 Update: tpm2-tss-3.2.2-1.fc36

tpm2-tss is a software stack supporting Trusted Platform ModuleTPM 2.0 syst em APIs. It sits between TPM driver and applications, providing TPM2.0 specified APIs for applications to access TPM module through kernel TPM drivers...