Affected versions of this package are vulnerable to Timing Attack. Practical recovery of the long-term private key generated by the library is possible under certain conditions. Leakage of bit-length of a scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.
elliptic to version 6.5.2 or higher.
- Centre for Research on Cryptography and Security
- Snyk ID
- 02 Oct, 2019
- 13 Nov, 2019