-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe GHSA explicitly identifies the add(), mul(), and getDouble() methods in the Point class as non-constant-time implementations, directly enabling timing side-channel attacks in EcDH operations. These methods are critical for scalar-point multiplication, and their variable execution time leaks private key information. While the ECDSA vulnerability involves GMPMath's non-constant-time arithmetic, the advisory does not specify exact function names within GMPMath, so only the explicitly named Point methods are included with high confidence.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mdanter/ecc | composer | >= 0, <= 1.0.0 |
PHPPHPOngoing coverage of React2Shell