CVE-2024-33851
mdanter/ecc affected by timing vulnerability in cryptographic side-channels
Impact
phpecc, as used in **all versions** of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. (This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library.) Paragon Initiative Enterprises [hard-forked phpecc/phpecc](https://github.com/phpecc/phpecc/issues/289) and discovered the issue in the original code, then released v2.0.1 which fixes the vulnerability. [The upstream code](https://github.com/phpecc/phpecc) is no longer maintained and remains vulnerable for all versions.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | paragonie/ecc | >= 0, < 2.0.1 | 2.0.1 |
| composer | mdanter/ecc | <= 1.0.0 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| Paragonie/Phpecc | before 2.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/paragonie/phpecc/releases/tag/v2.0.1
- https://github.com/advisories/GHSA-3494-cfwf-56hw
- https://nvd.nist.gov/vuln/detail/CVE-2024-33851
- https://github.com/phpecc/phpecc/issues/289
- https://github.com/FriendsOfPHP/security-advisories/blob/master/mdanter/ecc/CVE-2024-33851.yaml
- https://github.com/paragonie/phpecc/releases/tag/v2.0.0