CVE-2022-47931 Collision of hash values in github.com/bnb-chain/tss-lib

What is CVE-2022-47931?

CVE-2022-47931 is a medium-severity vulnerability in n/a, published on 22 Dec 2022.

Official description

IO FinNet tss-lib before 2.0.0 allows a collision of hash values.

Weakness: CWE-326

Which versions are affected by CVE-2022-47931?

4 open source packages ship an affected version, including github.com/bnb-chain/tss-lib and github.com/binance-chain/tss-lib. It affects 1 product.

Products include Iofinnet Tss-Lib.

How do I fix CVE-2022-47931?

Upgrade github.com/bnb-chain/tss-lib to 1.3.6-0.20230324145555-bb6fb30bd3eb or later.

Is CVE-2022-47931 being exploited?

There is no known exploitation of CVE-2022-47931 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-26556 IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar multiplication Critical 9.1
• CVE-2023-26557 IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar arithmetic High 7.5
• CVE-2022-47930 IO FinNet tss-lib vulnerable to replay attacks involving proofs Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cvcx-g7wh-x8rf, GO-2023-1904.