PT-2017-10866 · Frank Denis · Sodiumoxide

Publicado 2017-01-26 · Atualizado 2021-08-25 · CVE-2017-1000168

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions sodiumoxide versions 0.0.13 and older

Description The issue concerns the scalarmult() function, which accepted all-zero public keys. This results in the Diffie-Hellman shared secret always being zero, regardless of the private key used.

Recommendations For sodiumoxide versions 0.0.13 and older, update to a version that includes the fix for the scalarmult() function, which now checks for and rejects all-zero public keys.

Correção

Enumeração de Fraquezas

CWE-1240

Identificadores relacionados

CVE-2017-1000168

GHSA-2WC6-2RCJ-8V76

RUSTSEC-2017-0001

Produtos afetados

Sodiumoxide

Referências · 9

• https://github.com/dnaq/sodiumoxide/issues/154 · Nota
• https://github.com/sodiumoxide/sodiumoxide/commit/24c7a5550807ac8a09648b5878f19d14c3a69135 · Nota
• https://github.com/sodiumoxide/sodiumoxide · Nota
• https://osv.dev/vulnerability/RUSTSEC-2017-0001 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000168 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000168 · Nota de Segurança
• https://crates.io/crates/sodiumoxide · Nota
• https://rustsec.org/advisories/RUSTSEC-2017-0001.html · Nota
• https://osv.dev/vulnerability/GHSA-2wc6-2rcj-8v76 · Aviso do Fabricante