CVE-2020-12118

HIGH8.6EPSS 0.30%

Incorrect Default Permissions in Binance tss-lib

發布日:2021/6/29修改日:2024/8/21

也稱為:GHSA-399h-cmvp-qgx5GO-2022-0769

描述

The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties. ### Specific Go Packages Affected github.com/binance-chain/tss-lib/ecdsa/keygen

受影響套件(2)

Go/github.com/binance-chain/tss-libfrom 0, < 1.2.0
Go/github.com/binance-chain/tss-libfrom 0, < 1.2.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:R

參考連結(5)

ADVISORYhttps://github.com/advisories/GHSA-399h-cmvp-qgx5
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-12118
WEBhttps://github.com/binance-chain/tss-lib/pull/89
WEBhttps://github.com/binance-chain/tss-lib/pull/89/commits/7b7c17e90504d5dad94b938e84fec690bb1ec311
WEBhttps://github.com/binance-chain/tss-lib/releases/tag/v1.2.0