CVE-2023-49292
Medium
Description
ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.
SeverityMedium
CVSS4.9
Exploit probability—
ProductEcies Go
PublishedDec 5, 2023
First seenDec 5, 2023
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- ecies go2.0.8 or later
- github.com/ecies/go/v22.0.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ecies go | v < 2.0.8 | 2.0.8 |
| github.com/ecies/go/v2Go | v < 2.0.8 | 2.0.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.