CVE-2022-47930 IO FinNet tss-lib vulnerable to replay attacks involving proofs

What is CVE-2022-47930?

CVE-2022-47930 is a medium-severity vulnerability in n/a, published on 21 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.

Weakness: CWE-294

Which versions are affected by CVE-2022-47930?

6 open source packages ship an affected version, including github.com/binance-chain/tss-lib and github.com/bnb-chain/tss-lib. It affects 1 product.

Products include Iofinnet Tss-Lib.

How do I fix CVE-2022-47930?

Upgrade github.com/binance-chain/tss-lib to 2.0.0 or later.

Is CVE-2022-47930 being exploited?

There is no known exploitation of CVE-2022-47930 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-26556 IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar multiplication Critical 9.1
• CVE-2023-26557 IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar arithmetic High 7.5
• CVE-2022-47931 Collision of hash values in github.com/bnb-chain/tss-lib Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c58h-qv6g-fw74, GO-2023-1867.