ReportizFlow
PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_mod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction. This vulnerability is fixed in 0.2.1.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Svvqt |
|
No data.
No data.
References
History
Thu, 14 May 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Svvqt
Svvqt pyquorum |
|
| Vendors & Products |
Svvqt
Svvqt pyquorum |
Wed, 13 May 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_mod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction. This vulnerability is fixed in 0.2.1. | |
| Title | PyQuorum: Timing side‑channel in mul_mod | |
| Weaknesses | CWE-208 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-05-13T20:18:12.910Z
Updated: 2026-05-13T20:18:12.910Z
Reserved: 2026-05-05T20:15:20.631Z
Link: CVE-2026-44368
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-05-13T21:16:47.730
Modified: 2026-05-14T17:00:31.310
Link: CVE-2026-44368
Redhat
No data.