Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:46670
HistoryApr 29, 2024 - 7:35 a.m.

Information Disclosure Through Timing Attack

2024-04-2907:35:35
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
information disclosure
timing attack
point addition
non constant time
private key
software

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

mdanter/ecc is vulnerable to Sensitive Information Disclosure. The vulnerability is due to computing point addition in a non constant time, which allows an attacker to deduce the private key by comparing the time it takes to compute each point addition.

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%