#VU73264 Incorrect calculation in Go programming language - CVE-2023-24532

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU73264

#VU73264 Incorrect calculation in Go programming language - CVE-2023-24532

Published: March 13, 2023


Vulnerability identifier: #VU73264
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2023-24532
CWE-ID: CWE-682
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Go programming language
Software vendor:
Google

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars.


Remediation

Install updates from vendor's website.

External links