CVE-2023-26556

CRITICAL Year: 2023
CVSS v3 Score
9.1
Critical
Weakness Type
CWE-203
View all →

Vulnerability Description

io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/keygen/round_2.go. (bnb-chain/tss-lib and thorchain/tss are also affected.)

Related Vulnerabilities

CVE-2022-40895

CRITICAL
CVSS:9.1(Critical)

In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulne...

CWE-2032022

CVE-2024-25714

CRITICAL
CVSS:9.1(Critical)

In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the t...

CWE-2032024

CVE-2018-1000884

CRITICAL
CVSS:9.8(Critical)

Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Passwor...

CWE-2032018

CVE-2019-10071

CRITICAL
CVSS:9.8(Critical)

The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code ex...

CWE-2032019

CVE-2022-23303

CRITICAL
CVSS:9.8(Critical)

The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an inco...

CWE-2032022

CVE-2022-23304

CRITICAL
CVSS:9.8(Critical)

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an ...

CWE-2032022