VulnerabilityModified
CVE-2023-49292
If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it.
MEDIUM 4.8EPSS 0.34%
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.34% probability · 27th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- ecies/go
- Source
- security-advisories@github.com
References
- https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.mdExploit
- https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebdPatch
- https://github.com/ecies/go/releases/tag/v2.0.8Release Notes
- https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3hVendor Advisory
- https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.mdExploit
- https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebdPatch
- https://github.com/ecies/go/releases/tag/v2.0.8Release Notes
- https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3hVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.