When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
| Link | Tags |
|---|---|
| https://www.mozilla.org/security/advisories/mfsa2020-39/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2020-36/ | vendor advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1623116 | issue tracking permissions required vendor advisory |
| https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html | mailing list |