GHSA-3494-cfwf-56hw
mdanter/ecc affected by timing vulnerability in cryptographic side-channels
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | paragonie/ecc | < 2.0.1 | 2.0.1 |
| Packagist | mdanter/ecc | <= 1.0.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
phpecc, as used in **all versions** of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. (This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library.)
Paragon Initiative Enterprises [hard-forked phpecc/phpecc](https://github.com/phpecc/phpecc/issues/289) and discovered the issue in the original code, then released v2.0.1 which fixes the vulnerability. [The upstream code](https://github.com/phpecc/phpecc) is no longer maintained and remains vulnerable for all versions.
References
External links from the advisory. They lead to third-party sites.