Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

simplito/elliptic-php

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.4PackagistPublished

    Timing attacks might allow practical recovery of the long-term private key

    CVE-2019-10764 · GHSA-mr6r-82x4-f4jj

    Affected
    • Packagist simplito/elliptic-php < 1.0.6
    Fixed in
    1.0.6· Vendor fix available
    Issue
    In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.

    Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →