GitHub Advisoryadvisory · crates.io

GHSA-7cqg-8449-rmfv Observable Discrepancy in libsecp256k1-rs

MEDIUM Published 2021-08-25 Modified 2021-07-27 Official page ↗
Aliases
CVE-2019-20399
Ecosystem
crates.io
Packages
libsecp256k1-rs
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-203, CWE-362
Reviewed
2021-07-27

Affected packages

• crates.io libsecp256k1-rs: < 0.3.1 → fixed in 0.3.1

Description

A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.

Related

Alias · CVE (1)

  • CVE-2019-20399 A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak… vulnerability

Weakness · CWE (2)

  • CWE-203 Observable Discrepancy weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References