CVE-2019-10764

{"id": "CVE-2019-10764", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "published": "2019-11-18T22:15:11.157", "references": [{"url": "https://minerva.crocs.fi.muni.cz/", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-PHP-SIMPLITOELLIPTICPHP-534576", "tags": ["Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://minerva.crocs.fi.muni.cz/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://snyk.io/vuln/SNYK-PHP-SIMPLITOELLIPTICPHP-534576", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key."}, {"lang": "es", "value": "En elliptic-php versiones anteriores a 1.0.6, ataques de sincronizaci\u00f3n pueden ser posibles, lo que resulta en la recuperaci\u00f3n pr\u00e1ctica de la clave privada a largo plazo generada por la biblioteca bajo determinadas condiciones. La fuga de una longitud de bits del escalar durante la multiplicaci\u00f3n escalar es posible sobre una curva de elliptic que podr\u00eda permitir la recuperaci\u00f3n pr\u00e1ctica de la clave privada a largo plazo."}], "lastModified": "2024-11-21T04:19:52.587", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:simplito:elliptic-php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BAD364B-8CA6-481A-8BD3-04D6C9FB4911", "versionEndExcluding": "1.0.6"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}