CVE-2020-12118: High severity binance vulnerability
Published Apr 23, 2020
·Updated
The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties.
Affected Software
2 affected componentsFixes available
go/github.com/binance-chain/tss-lib<1.2.0
1.2.0
Binance tss-lib<1.2.0
Remediation
Patch Available
Event History
Apr 23, 2020
CVE Published
via MITRE·09:28 PM
Data Sourced
via MITRE·09:28 PM
Description
Jun 29, 2021
Advisory Published
09:32 PM
Frequently Asked Questions
1
What is the severity of CVE-2020-12118?
CVE-2020-12118 has a high severity rating as it allows attackers to compromise a signing round or access sensitive information.
2
How do I fix CVE-2020-12118?
To fix CVE-2020-12118, upgrade to Binance tss-lib version 1.2.0 or later.
3
Who is affected by CVE-2020-12118?
CVE-2020-12118 affects all versions of Binance tss-lib prior to 1.2.0.
4
What kind of exploitation is possible with CVE-2020-12118?
Exploitation of CVE-2020-12118 can lead to crafted h1 and h2 parameters affecting cryptographic signing processes.
5
Is CVE-2020-12118 a remote execution vulnerability?
CVE-2020-12118 is not categorized as a remote execution vulnerability but rather involves information disclosure and signing round compromise.