cve.bz

CVE-2023-26557

7.5 highEPSS 0.9%

High (7.5) in iofinnet tss-lib. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in github.com/bnb-chain/tss-lib 1.3.6-0.20230324145555-bb6fb30bd3eb.

io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. (bnb-chain/tss-lib and thorchain/tss are also affected.)

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE
CWE-203
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-mjqv-xhgm-gx8cGogithub.com/bnb-chain/tss-lib<1.3.6-0.20230324145555-bb6fb30bd3eb1.3.6-0.20230324145555-bb6fb30bd3eb
GHSA-mjqv-xhgm-gx8cGogithub.com/binance-chain/tss-lib<1.3.6-0.20230324145555-bb6fb30bd3eb1.3.6-0.20230324145555-bb6fb30bd3eb
GO-2023-1733Gogithub.com/bnb-chain/tss-lib<1.3.6-0.20230324145555-bb6fb30bd3eb1.3.6-0.20230324145555-bb6fb30bd3eb
GO-2023-1733Gogithub.com/binance-chain/tss-liball versionsno fix published

References

Check your stackJSON