CVE-2023-49292 Possible private key restoration in go package github.com/ecies/go
An attacker can recover private keys by interacting with specific ECIES functions in the Go library, compromising encrypted data confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49292?
CVE-2023-49292 is a medium-severity vulnerability in ecies go, published on 4 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.
Weakness: CWE-200
Which versions are affected by CVE-2023-49292?
3 open source packages ship an affected version, including github.com/ecies/go/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ecies/go/v2 Go | All versions | 2.0.8 |
github.com/ecies/go/v2 Go | All versions | 2.0.8 |
github.com/ecies/go/v2 Go | All versions | 2.0.8 |
Products include Ecies Go.
How do I fix CVE-2023-49292?
Upgrade github.com/ecies/go/v2 to 2.0.8 or later.
Is CVE-2023-49292 being exploited?
There is no known exploitation of CVE-2023-49292 in the wild and no public exploit code.
Sources
Also known as AZL-37343, AZL-37392, AZL-58246, AZL-78898, GHSA-8j98-cjfr-qx3h, GO-2023-2380.