Vulnerability · Published Dec 4, 2023 · Assigned by GitHub_M
CVE-2023-49292Possible private key restoration in go package github.com/ecies/go
Medium 4.9
In plain English
A medium-severity information exposure in go from ecies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.3%top 73.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/ecies/go/v2 | 2.0.8 | GHSA-8j98-cjfr-qx3h |
| Go | github.com/ecies/go/v2 | 2.0.8 | GO-2023-2380 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
References
- https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3h x_refsource_CONFIRM
- https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebd x_refsource_MISC
- https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md x_refsource_MISC
- https://github.com/ecies/go/releases/tag/v2.0.8 x_refsource_MISC