CVE-2023-24532

EPSS 0.02%
Veröffentlicht 08.03.2023 20:15:09
Zuletzt bearbeitet 21.11.2024 07:48:04
Quelle security@golang.org
Teams Watchlist Login
Unerledigt Login

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Golang ≫ Go Version < 1.19.7

Golang ≫ Go Version >= 1.20.0 < 1.20.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.02%	0.048

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-682 Incorrect Calculation

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

https://go.dev/cl/471255

Patch

https://go.dev/issue/58647

Patch

Issue Tracking

https://groups.google.com/g/golang-announce/c/3-TpUx48iQY

Mailing List

Release Notes

https://pkg.go.dev/vuln/GO-2023-1621

Third Party Advisory

https://security.netapp.com/advisory/ntap-20230331-0011/

https://nvd.nist.gov/vuln/detail/CVE-2023-24532

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-24532

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-24532

EUVD