A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
References:MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTdjcWctODQ0OS1ybWZ2
Observable Discrepancy in libsecp256k1-rs
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
|
cargo:libsecp256k1-rs
PURL:
pkg:cargo/libsecp256k1-rs
|
< 0.3.1 | 0.3.1 | |
Affected Version RangesAll affected versions0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4 All unaffected versions |
|||