CVE-2022-44310 ecdh vulnerable to Exposure of Resource to Wrong Sphere
An attacker can obtain the derived shared secret by sending an invalid public key point in the Development IL ecdh library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-44310?
CVE-2022-44310 is a high-severity vulnerability in n/a, published on 24 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.
Weakness: CWE-668
Which versions are affected by CVE-2022-44310?
2 open source packages ship an affected version, including ecdh. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ecdh npm | All versions | 0.2.0 |
ecdh npm | All versions | 0.2.0 |
Products include Ecdh Project Ecdh.
How do I fix CVE-2022-44310?
Upgrade ecdh to 0.2.0 or later.
Is CVE-2022-44310 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-44310 exists.
Sources
Also known as GHSA-p2hp-3wv3-4w74.