paragonie/ecc
Pure PHP Elliptic Curve Cryptography Library
View on Github
Activity
- Latest release
- 3w ago
- Total releases
- 8
- Cadence
- ~3 days
- Last 12 months
- 1
Reach
- Stars
- 24
Details
- License
- MIT
- First release
- Apr 24, 2024
Releases
| Version | Released | |
|---|---|---|
v2.6.0
minor
| ||
v2.5.0
minor
| ||
v2.4.0
minor
| ||
v2.3.0
minor
| ||
v2.2.0
minor
| ||
v2.1.0
minor
| ||
v2.0.1
patch
| ||
v2.0.0
initial
1 CVE
CVE-2024-33851
GHSA-3494-cfwf-56hw
Apr 28, 2024
mdanter/ecc affected by timing vulnerability in cryptographic side-channels
Medium
Network
Low
Low
None
phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. (This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library.) Paragon Initiative Enterprises hard-forked phpecc/phpecc and discovered the issue in the original code, then released v2.0.1 which fixes the vulnerability. The upstream code is no longer maintained and remains vulnerable for all versions. Affected versions
v2.0.0
Fixed in
2.0.1
References Updated Dec 05, 2024 · Source: OSV.dev |