Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:39607
HistoryMar 09, 2023 - 11:15 a.m.

Incorrect ECC Calculation

2023-03-0911:15:16
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
23
go
crypto
elliptic
vulnerable
incorrect ecc
calculation
p256 curve
cryptography

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

0.001 Low

EPSS

Percentile

39.9%

Go is vulnerable to Incorrect ECC Calculation in its crypto/elliptic package. The vulnerability is due to defects in the functions ScalarBaseMult and ScalarMult in p256_asm.go and p256_ordinv.go files while performing P256 Curve implementation of Elliptic-curve cryptography (ECC). The functions do not return the correct value if the two input values are equal.

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

0.001 Low

EPSS

Percentile

39.9%