Detections
Analytics
SCA: security update for github.com/binance-chain/tss-lib, github.com/bnb-chain/tss-lib (GHSA-3w84-4mjc-rjw7)
critical Tenable Self-Hosted Container Security Plugin ID 421699
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on
the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if
statement in a loop). One leak is in ecdsa/keygen/round_2.go. (bnb-chain/tss-lib and thorchain/tss are
also affected.) (CVE-2023-26556)
See Also
Plugin Details
Severity: Critical
ID: 421699
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 3/28/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.04
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: High
Base Score: 9.4
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N
CVSS Score Source: CVE-2023-26556
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 4/21/2023
Vulnerability Publication Date: 4/21/2023
Reference Information
CVE: CVE-2023-26556
cwe: CWE-203