-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/bnb-chain/tss-lib | go | < 1.3.6-0.20230324145555-bb6fb30bd3eb | 1.3.6-0.20230324145555-bb6fb30bd3eb |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from insecure input concatenation in hash functions. The patch in commit 369ec50 modified both SHA512_256 and SHA512_256i to add binary-encoded length prefixes instead of string delimiters. The CVE description specifically mentions hash collisions related to these functions' input handling, and the GitHub advisory links to a fix that directly modifies these functions in hash.go. The medium.com analysis explicitly cites these functions as the source of CVE-2022-47931.
GoGoOngoing coverage of React2Shell