Information disclosure in Ecies Go
CVE-2023-49292
ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.
Vulnerability class: Information Disclosure
EPSS: 0.003 (26.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N.
Affected products
- Ecies Go — versions < 2.0.8
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Exploit, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2023-49292?
- CVE-2023-49292 is a medium-severity vulnerability in Ecies Go, classified under Information Disclosure. CVSS score: 4.9/10. Published 2023-12-05.
- How severe is CVE-2023-49292?
- Medium severity. CVSS v3 base score is 4.9 out of 10.