GHSA-xmc3-9m9j-w9x4

cocagne pysrp vulnerable to side channel leaks

Source: GitHub Advisory Database (reviewed) High CVE-2021-4286

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	srp	< 1.0.17	1.0.17

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file `srp/_ctsrp.py`. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. The name of the patch is dba52642f5e95d3da7af1780561213ee6053195f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216875.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-4286 advisory
https://github.com/cocagne/pysrp/pull/43 web
https://github.com/cocagne/pysrp/commit/dba52642f5e95d3da7af1780561213ee6053195f web
https://github.com/cocagne/pysrp package
https://github.com/cocagne/pysrp/releases/tag/1.0.17 web
https://github.com/pypa/advisory-database/tree/main/vulns/srp/PYSEC-2022-43014.yaml web
https://vuldb.com/?ctiid.216875 web
https://vuldb.com/?id.216875 web