CVE-2023-49292

ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md	Exploit
https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebd	Patch
https://github.com/ecies/go/releases/tag/v2.0.8	Release Notes
https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3h	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ecies:go:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-12-05 00:15

Updated : 2023-12-08 17:20

NVD link : CVE-2023-49292

Mitre link : CVE-2023-49292

CVE.ORG link : CVE-2023-49292

JSON object : View

Products Affected

ecies

go

CWE

NVD-CWE-noinfo CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2023-49292", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.8}]}, "published": "2023-12-05T00:15:09.627", "references": [{"url": "https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md", "tags": ["Exploit"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebd", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ecies/go/releases/tag/v2.0.8", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3h", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade."}, {"lang": "es", "value": "ecies es un esquema de cifrado integrado de curva el\u00edptica para secp256k1 en Golang. Si un atacante pudiera llamar a las funciones Encapsulate(), Decapsulate() y ECDH(), podr\u00eda recuperar cualquier clave privada que interact\u00fae con ellas. Esta vulnerabilidad fue parcheada en 2.0.8. Se recomienda a los usuarios que actualicen."}], "lastModified": "2023-12-08T17:20:40.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ecies:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B03A6379-B738-4870-806D-614DC8B1ADE2", "versionEndExcluding": "2.0.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}