GHSA-399h-cmvp-qgx5

Incorrect Default Permissions in Binance tss-lib

Source: GitHub Advisory Database (reviewed) High CVE-2020-12118

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/binance-chain/tss-lib	< 1.2.0	1.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties. ### Specific Go Packages Affected github.com/binance-chain/tss-lib/ecdsa/keygen

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-12118 advisory
https://github.com/binance-chain/tss-lib/pull/89 web
https://github.com/binance-chain/tss-lib/pull/89/commits/7b7c17e90504d5dad94b938e84fec690bb1ec311 web
https://github.com/binance-chain/tss-lib/releases/tag/v1.2.0 web