CVE-2020-12118: Incorrect Default Permissions in Binance tss-lib
Summary
CVE-2020-12118: Incorrect Default Permissions in Binance tss-lib. Affects github.com/binance-chain/tss-lib versions < 1.2.0. Fixed in 1.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Binance tss-lib is a Go package that provides a key generation protocol implementation for the Binance Chain. It is used for generating cryptographic keys in the context of the Binance Chain's transaction signing process. The package is an essential component of the Binance Chain ecosystem and is widely utilized by developers for secure key generation. However, a vulnerability has been discovered in versions prior to 1.2.0 that could lead to compromised signing rounds or the unauthorized access of sensitive information from other parties.
Vulnerability Detail
The vulnerability, identified as CVE-2020-12118, arises from an incorrect default permission setting in the keygen protocol implementation of Binance tss-lib. Attackers can exploit this flaw by generating crafted h1 and h2 parameters. This can result in the compromise of a signing round or the extraction of sensitive information from other participants. The impact of this vulnerability can be severe, potentially leading to unauthorized transactions, data leakage, or the manipulation of cryptographic keys.
How To Fix
Latest published version: v1.3.3 as of 22 Oct 2026
go get github.com/binance-chain/tss-lib@v1.3.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.0
This is the first release that contains the fix.
go get github.com/binance-chain/tss-lib@v1.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the Binance tss-lib package prior to version 1.2.0 is vulnerable to an incorrect default permissions issue. This can be exploited by attackers to compromise signing rounds or obtain sensitive information. It is crucial for developers to update to the fixed version of the package and ensure its integration into their applications. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/binance-chain/tss-lib →
FAQ
Binance tss-lib is a Go package used for key generation in the Binance Chain's transaction signing process. It provides a secure protocol implementation for generating cryptographic keys.
The vulnerability can lead to compromised signing rounds or the unauthorized access of sensitive information from other parties. This can result in unauthorized transactions, data leakage, or the manipulation of cryptographic keys.
To fix this vulnerability, update the Binance tss-lib package to version 1.2.0 or later. Ensure that the updated package is integrated into your application and update any dependencies accordingly.
No, there are no known workarounds for this vulnerability. It is recommended to update to the fixed version of the package.
For more information about this vulnerability, you can refer to the CVE-2020-12118 entry or contact the Binance tss-lib development team.
