CVE-2019-10764
HIGHelliptic-php < 1.0.6 - Timing Attack Leading to Private Key Recovery
Title source: llmDescription
In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://minerva.crocs.fi.muni.cz/
Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-PHP-SIMPLITOELLIPTICPHP-534576
Scores
CVSS v3
7.4
EPSS
0.0109
EPSS Percentile
61.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Details
CWE
CWE-203
Status
published
Products (2)
simplito/elliptic-php
< 1.0.6
simplito/elliptic-php
0 - 1.0.6Packagist
Published
Nov 18, 2019
Tracked Since
Feb 18, 2026