Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zNDk0LWNmd2YtNTZod84AA7Wr

mdanter/ecc affected by timing vulnerability in cryptographic side-channels

phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. (This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library.)

Paragon Initiative Enterprises hard-forked phpecc/phpecc and discovered the issue in the original code, then released v2.0.1 which fixes the vulnerability. The upstream code is no longer maintained and remains vulnerable for all versions.

Permalink: https://github.com/advisories/GHSA-3494-cfwf-56hw
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zNDk0LWNmd2YtNTZod84AA7Wr
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 7 months ago
Updated: 24 days ago

CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Identifiers: GHSA-3494-cfwf-56hw, CVE-2024-33851
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-33851
• https://github.com/paragonie/phpecc/releases/tag/v2.0.1
• https://github.com/phpecc/phpecc/issues/289
• https://github.com/FriendsOfPHP/security-advisories/blob/master/mdanter/ecc/CVE-2024-33851.yaml
• https://github.com/paragonie/phpecc/releases/tag/v2.0.0
• https://github.com/advisories/GHSA-3494-cfwf-56hw

Repository: https://github.com/paragonie/phpecc
Blast Radius: 11.7

Affected Packages