SB2024080828 - Permissions, privileges, and access controls in ecies go
Published: August 8, 2024
Security Bulletin ID
SB2024080828
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-49292)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions. A remote attacker can call functions Encapsulate(), Decapsulate() and ECDH() to recover any private key that interacts with it.
Remediation
Install update from vendor's website.
References
- https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3h
- https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebd
- https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md
- https://github.com/ecies/go/releases/tag/v2.0.8