Potential secutiry vulnerability in the shared library which electrumsv-secp256k1 depends on. Can you help upgrade to patch versions?

[andy201709]

Hi, @ofek , @rt121212121 , I'd like to report a vulnerability issue in electrumsv-secp256k1_0.9.4.

Dependency Graph between Python and Shared Libraries

Issue Description

As shown in the above dependency graph, electrumsv-secp256k1_0.9.4 directly or transitively depends on 2 C libraries (.so). However, I noticed that one C library is vulnerable, containing the following CVEs:
libgmp-4c77cc8e.so.10.3.2 from C project gmp(version:<=6.1.0) exposed 1 vulnerabilities:
CVE-2021-43618

Suggested Vulnerability Patch Versions

No official patch version released, but gmp has fixed the vulnerability in patch.

Python build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Python projects.
As a popular python package (electrumsv-secp256k1 has 5,254 downloads per month), could you please upgrade the above shared libraries to their patch versions?

Thanks for your help~
Best regards,
Andy

[ofek]

New versions of https://github.com/ofek/coincurve / https://github.com/bitcoin-core/secp256k1 no longer use GMP

[rt121212121]

Thanks for the report. We do not do 32-bit releases any more, and this is a 32-bit problem. If gmp had made a release, we would upgrade to support that regardless.

[andy201709]

Thanks for your feedback. @ofek

[andy201709]

@rt121212121 , thanks for your feedback.

Is the diagnosis information useful to you? I am happy to know that :)
Our team developed a tool that can detect the vulnerablity issues that are induced by cross-language invocations.
If you are interests, I can share you a download link when we make it open-source.

[rt121212121]

I don't know. It depends on what the tool does and how much work it incurs. With this report and possibly many like it, it is very difficult to see how it would be abused even if it were relevant.