GitHub Advisoryadvisory · Go

GHSA-399h-cmvp-qgx5 Incorrect Default Permissions in Binance tss-lib

HIGH Published 2021-06-29 Modified 2023-10-02 Official page ↗
Aliases
CVE-2020-12118
Ecosystem
Go
Packages
github.com/binance-chain/tss-lib
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:R
Weaknesses
CWE-276
Reviewed
2021-05-25

Affected packages

• Go github.com/binance-chain/tss-lib: < 1.2.0 → fixed in 1.2.0

Description

The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties. Specific Go Packages Affected github.com/binance-chain/tss-lib/ecdsa/keygen

Related

Alias · CVE (1)

  • CVE-2020-12118 The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References