← Voltar para CVEs
CVE-2023-49292
MEDIUM4.9
Descricao
ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.
Detalhes CVE
Pontuacao CVSS v3.14.9
SeveridadeMEDIUM
Vetor CVSSCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Vetor de ataqueNETWORK
ComplexidadeHIGH
Privilegios necessariosLOW
Interacao do usuarioNONE
Publicado12/5/2023
Ultima modificacao11/21/2024
Fontenvd
Avistamentos honeypot0
Produtos afetados
ecies:go
Fraquezas (CWE)
CWE-200
Referencias
https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md(security-advisories@github.com)
https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebd(security-advisories@github.com)
https://github.com/ecies/go/releases/tag/v2.0.8(security-advisories@github.com)
https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3h(security-advisories@github.com)
https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebd(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/ecies/go/releases/tag/v2.0.8(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3h(af854a3a-2127-422b-91ae-364da2661108)
Correlacoes IOC
Sem correlacoes registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.