Vulnerability · Published Mar 8, 2023 · Assigned by Go
CVE-2023-24533Incorrect multiplication of unreduced P-256 scalars in filippo.io/nistec
High 7.5
In plain English
A high-severity security flaw in filippo.io/nistec from filippo.io/nistec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | filippo.io/nistec | 0.0.2 | GHSA-f6hc-9g49-xmx7 |
| Go | filippo.io/nistec | 0.0.2 | GO-2023-1595 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| filippo.io/nistec | filippo.io/nistec | 0 – before 0.0.2 |