CVE-2019-20399

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-203

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/paritytech/libsecp256k1/commit/11ba23a9766a5079918cd9f515bc100bc8164b50Patch, Third Party Advisory
https://github.com/paritytech/libsecp256k1/commit/11ba23a9766a5079918cd9f515bc100bc8164b50Patch, Third Party Advisory

Timeline

Published: Jan 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-20405.0In rw_i93_process_ext_sys_info of rw_i93.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local i CVE-2019-204007.8The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global pat CVE-2019-204016.5Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet fin CVE-2019-204024.9Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without r CVE-2019-204035.3The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or n CVE-2019-204044.3The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they CVE-2019-204054.3The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring fla CVE-2019-204067.8The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.CVE-2019-204074.3The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attacker CVE-2019-204085.3The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal net CVE-2019-204099.8The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to ga CVE-2019-20417.3In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices due to an insecure def