CVE-2023-49292

medium

Description

ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.

References

https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3h

https://github.com/ecies/go/releases/tag/v2.0.8

https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebd

https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md

Details

Source: Mitre, NVD

Published: 2023-12-05

Updated: 2023-12-08

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 4.8

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.00142