CVE-2019-10764 Timing attacks might allow practical recovery of the long-term private key
Timing attacks in elliptic-php may leak scalar bit-length, enabling practical recovery of long-term private keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10764?
CVE-2019-10764 is a high-severity vulnerability in simplito/elliptic-php, published on 18 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.
Weakness: CWE-203
Which versions are affected by CVE-2019-10764?
2 open source packages ship an affected version, including simplito/elliptic-php. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
simplito/elliptic-php Packagist | All versions | 1.0.6 |
simplito/elliptic-php Packagist | All versions | 1.0.6 |
Products include Simplito Elliptic-Php.
How do I fix CVE-2019-10764?
Upgrade simplito/elliptic-php to 1.0.6 or later.
Is CVE-2019-10764 being exploited?
There is no known exploitation of CVE-2019-10764 in the wild and no public exploit code.
Sources
Also known as GHSA-mr6r-82x4-f4jj, SNYK-PHP-SIMPLITOELLIPTICPHP-534576.