PyQuorum versions before 0.2.1 contain a timing side-channel vulnerability in the mul_mod function used for secret sharing and key management. The function's execution time varies based on the Hamming weight of the exponent, which can be observed by an attacker measuring the timing of secret-sharing operations remotely. This timing discrepancy (CWE-208) can be exploited to recover secret shares incrementally, potentially leading to full secret reconstruction. The vulnerability is addressed in pyquorum version 0.2.1.

An attacker capable of measuring the timing of secret-sharing operations can exploit this vulnerability to recover secret shares by analyzing timing discrepancies. This can lead to the compromise of the secret managed by the pyquorum library. There are no known exploits in the wild at this time.

Upgrade pyquorum to version 0.2.1 or later, where the timing side-channel vulnerability in the mul_mod function has been fixed. Patch status is not explicitly confirmed beyond this version update, so users should verify they are running 0.2.1 or newer.