CVE-2023-24533

2023-03-0820:15:09

CWE-682

web.nvd.nist.gov

cve-2023-24533

p-256

scalar multiplication

security issue

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

38.8%

JSON

Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this.

Affected configurations

Nvd

Node

nistec_projectnistecRange<0.0.2go

VendorProductVersionCPE
nistec_projectnistec*cpe:2.3:a:nistec_project:nistec:*:*:*:*:*:go:*:*

Vendor	Product	Version	CPE
nistec_project	nistec	*	cpe:2.3:a:nistec_project:nistec::::::go::*

CNA Affected

[
  {
    "vendor": "filippo.io/nistec",
    "product": "filippo.io/nistec",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "filippo.io/nistec",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.0.2",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "p256OrdInverse"
      },
      {
        "name": "P256Point.ScalarBaseMult"
      },
      {
        "name": "P256Point.ScalarMult"
      }
    ],
    "defaultStatus": "unaffected"
  }
]