Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1yNnItODJ4NC1mNGpq

Timing attacks might allow practical recovery of the long-term private key

In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.

Permalink: https://github.com/advisories/GHSA-mr6r-82x4-f4jj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1yNnItODJ4NC1mNGpq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 4 years ago
Updated: over 1 year ago

CVSS Score: 7.4
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-mr6r-82x4-f4jj, CVE-2019-10764
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-10764
• https://github.com/simplito/elliptic-php/commit/15652609aa55968d56685c2a9120535ccdc00fd9
• https://minerva.crocs.fi.muni.cz/
• https://snyk.io/vuln/SNYK-PHP-SIMPLITOELLIPTICPHP-534576
• https://github.com/advisories/GHSA-mr6r-82x4-f4jj

Repository: https://github.com/simplito/elliptic-php
Blast Radius: 17.7

Affected Packages