CVE-2022-23004

When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the library, and an invalid unreduced value is written to the output buffer. This may be leveraged by an attacker to cause an error scenario,...

CVE-2022-23003

When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output may cause an error when used in other operations. This may be...

CVE-2022-23003

When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output may cause an error when used in other operations. This may be...

Code injection

When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output will cause an error when used in other operations. This may be leveraged by an...

Code injection

When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the library, and an invalid unreduced value is written to the output buffer. This may be leveraged by an attacker to cause an error scenario,...

Code injection

When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output may cause an error when used in other operations. This may be...

CVE-2022-23004 Algorithm incorrectly returning error and Invalid unreduced value written to output buffer

When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the library, and an invalid unreduced value is written to the output buffer. This may be leveraged by an attacker to cause an error scenario,...

CVE-2022-23004

CVE-2022-23004 affects the Western Digital Sweet B library (ECC on NIST P-256). When performing a shared secret calculation or point multiplication with a public key whose X coordinate is zero, the library returns an error and writes an invalid unreduced value to the output buffer, potentially al...

CVE-2022-23003 Shared secret or Point multiplication of NIST P-256 points with X coordinate of zero

When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output may cause an error when used in other operations. This may be...

CVE-2022-23003

CVE-2022-23003 involves computing a shared secret or point multiplication on the NIST P-256 curve where an X coordinate of zero yields an output not properly reduced modulo the P-256 field prime, making it invalid. The documented impact is a potential error or incorrect session-key choice in affe...

CVE-2022-23002 Point Compression/Decompression of NIST P-256 points with X coordinate of zero

When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output will cause an error when used in other operations. This may be leveraged by an...

CVE-2022-23002

CVE-2022-23002 affects the Western Digital Sweet B library (ECC over NIST P-256) during point compression/decompression when the X coordinate is zero. The output is not properly reduced modulo the P-256 field prime, producing an invalid value that triggers an error in subsequent operations. This ...

PT-2022-15771 · Western Digital +1 · Sweet B Library +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue occurs when compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero. The resulting output is not...

PT-2022-15772 · Western Digital +1 · Sweet B Library +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue arises when computing a shared secret or point multiplication on the NIST P-256 curve, resulting in an X coordinate of zero. The output is not...

PT-2022-15773 · Western Digital +1 · Sweet B Library +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned fro...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2022-2132)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 8 : go-toolset:ol8addon (ELSA-2022-17956)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-17956 advisory. go-toolset 1.18.3-1 - Update to golang 1.18.3 golang 1.18.3-1.0.1 - Rebase to 1.18.3 by adding upstream patches to the 1.18.0 openssl-fips - Modify...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-1996)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. CVE-2022-24675 - The gener...

GO-2022-0187 Incorrect computation for P-256 curves in crypto/elliptic

The ScalarMult implementation of curve P-256 for amd64 architectures generates incorrect results for certain specific input points. An adaptive attack can progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to derive correct output. This leads ...

EulerOS 2.0 SP8 : golang (EulerOS-SA-2022-1930)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. CVE-2022-24675 - The gener...