CVE-2023-33242

Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt (256 in total) because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed signature.

• CWE-74

• https://eprint.iacr.org/2017/552.pdfExploit, Third Party Advisory
• https://github.com/fireblocks-labs/mpc-ecdsa-attacks-23Exploit
• https://github.com/fireblocks-labs/zengo-lindell17-exploit-pocExploit
• https://www.fireblocks.com/blog/lindell17-abort-vulnerability-technical-report/Third Party Advisory
• https://eprint.iacr.org/2017/552.pdfExploit, Third Party Advisory
• https://github.com/fireblocks-labs/mpc-ecdsa-attacks-23Exploit
• https://github.com/fireblocks-labs/zengo-lindell17-exploit-pocExploit
• https://www.fireblocks.com/blog/lindell17-abort-vulnerability-technical-report/Third Party Advisory

Published

Aug 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-33237TN-5900 Series firmware version v3.3 and prior is vulnerable…8.8
• CVE-2023-33238TN-4900 Series firmware versions v1.2.4 and prior and TN-590…9.8
• CVE-2023-33239TN-4900 Series firmware versions v1.2.4 and prior and TN-590…9.8
• CVE-2023-3324 A vulnerability exists by allowing low-privileged users to …7.5
• CVE-2023-33240Foxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Ed…7.8
• CVE-2023-33241Crypto wallets implementing the GG18 or GG20 TSS protocol mi…9.1
• CVE-2023-33243RedTeam Pentesting discovered that the web interface of STAR…8.1
• CVE-2023-33244Obsidian before 1.2.2 allows calls to unintended APIs (for m…8.2
• CVE-2023-33245Minecraft through 1.19 and 1.20 pre-releases before 7 (Java)…8.8
• CVE-2023-33246For RocketMQ versions 5.1.0 and below, under certain conditi…9.8
• CVE-2023-33247Talend Data Catalog remote harvesting server before 8.0-2023…7.5
• CVE-2023-33248Amazon Alexa software version 8960323972 on Echo Dot 2nd gen…7.6