high7.5
CVE-2019-25003
libsecp256k1 contains side-channel timing attack
Impact
Versions of libsecp256k1 prior to 0.3.1 did not execute `Scalar::check_overflow` in constant time. This allows an attacker to potentially leak information via a timing attack. The flaw was corrected by modifying `Scalar::check_overflow` to execute in constant time.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | libsecp256k1 | < 0.3.1 | 0.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Parity | Libsecp256k1 | before 0.3.1 |