Vulnerability · Published Apr 21, 2023 · Assigned by mitre
CVE-2022-47930
Medium 6.8
In plain English
A medium-severity security flaw in the github.com/binance-chain/tss-lib package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/binance-chain/tss-lib | 2.0.0 | GHSA-c58h-qv6g-fw74 |
| Go | github.com/binance-chain/tss-lib | no fix listed | GO-2023-1867 |
| Go | github.com/bnb-chain/tss-lib | 2.0.0 | GHSA-c58h-qv6g-fw74 |
| Go | github.com/bnb-chain/tss-lib | no fix listed | GO-2023-1867 |
Affected products (as reported)
Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N