CVE-2020-12118: Incorrect Default Permissions

June 29, 2021 (updated October 2, 2023)

The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties.

References

github.com/advisories/GHSA-399h-cmvp-qgx5
github.com/binance-chain/tss-lib/pull/89
github.com/binance-chain/tss-lib/pull/89/commits/7b7c17e90504d5dad94b938e84fec690bb1ec311
github.com/binance-chain/tss-lib/releases/tag/v1.2.0
nvd.nist.gov/vuln/detail/CVE-2020-12118

Code Behaviors & Features

Detect and mitigate CVE-2020-12118 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →