GitHub Advisoryadvisory · Packagist

GHSA-mr6r-82x4-f4jj Timing attacks might allow practical recovery of the long-term private key

HIGH Published 2019-11-20 Modified 2021-08-18 Official page ↗
Aliases
CVE-2019-10764
Ecosystem
Packagist
Packages
simplito/elliptic-php
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-203
Reviewed
2019-11-19

Affected packages

• Packagist simplito/elliptic-php: < 1.0.6 → fixed in 1.0.6

Description

In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.

Related

Alias · CVE (1)

  • CVE-2019-10764 In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private… vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References