PT-2023-14449 · Unknown · In Development Il Ecdh

Shilohshio · Publicado 2023-02-24 · Atualizado 2025-03-12 · CVE-2022-44310

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions In Development IL ecdh versions prior to 0.2.0

Description An attacker can send an invalid point, not on the curve, as the public key and obtain the derived shared secret. This issue allows an attacker to potentially exploit the system by manipulating the public key exchange process.

Recommendations For versions prior to 0.2.0, update to version 0.2.0 or later to resolve the issue. As a temporary workaround, consider implementing additional validation on public keys to ensure they are valid points on the curve before deriving the shared secret.

Exploit

Correção

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

CVE-2022-44310

GHSA-P2HP-3WV3-4W74

Produtos afetados

In Development Il Ecdh

Referências · 10

• 🔥 https://github.com/developmentil/ecdh/issues/3 · Exploit
• https://github.com/developmentil/ecdh/pull/4 · Nota
• https://github.com/developmentil/ecdh · Nota
• https://github.com/developmentil/ecdh/commit/ef4560e7233f4e8107a17a77bc540121599c78fa · Nota
• https://t.me/cvenotify/114479 · Publicação no Telegram
• https://t.me/cibsecurity/58889 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-44310 · Aviso do Fabricante
• https://t.me/cvenotify/45693 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-44310 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-p2hp-3wv3-4w74 · Aviso do Fabricante