VulnerabilityModified
CVE-2023-24532
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve).
MEDIUM 5.3EPSS 0.82%
Does this matter?
Lower severity and a low EPSS score (0.82%). Track it; it rarely justifies an emergency change on its own.
Description
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.82% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-682
- Affected
- golang/go
- Source
- security@golang.org
References
- https://go.dev/cl/471255Patch
- https://go.dev/issue/58647Issue Tracking, Patch
- https://groups.google.com/g/golang-announce/c/3-TpUx48iQYMailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2023-1621Third Party Advisory
- https://go.dev/cl/471255Patch
- https://go.dev/issue/58647Issue Tracking, Patch
- https://groups.google.com/g/golang-announce/c/3-TpUx48iQYMailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2023-1621Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230331-0011/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.