SecuritySpace - CVE-2022-47930

Vulnerability Search		Search 324607 CVE descriptions and 146377 test descriptions, access 10,000+ cross references.
	Tests CVE All

CVE ID: CVE-2022-47930

Description: An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.

Test IDs: 1.3.6.1.4.1.25623.1.1.18.2.2025.0429.1

Cross References: Common Vulnerability Exposure (CVE) ID: CVE-2022-47930
https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0
https://medium.com/@iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b

CVE ID:	CVE-2022-47930
Description:	An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.
Test IDs:	1.3.6.1.4.1.25623.1.1.18.2.2025.0429.1
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2022-47930 https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0 https://medium.com/@iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b