PT-2022-15771 · Western Digital+1 · Sweet B Library+1

Published 2022-07-29 · Updated 2022-08-05 · CVE-2022-23002

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue occurs when compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero. The resulting output is not properly reduced modulo the P-256 field prime and is invalid. This may cause an error when used in other operations, potentially allowing an attacker to leverage it for a limited denial of service attack against an individual user. The impact is limited to applications using the affected library and cannot extend to other components.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-703

Related Identifiers

CVE-2022-23002

Affected Products

Sweet B Library

Sweet B

References · 5

• https://westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23002 · Security Note
• https://t.me/cibsecurity/47282 · Telegram Post
• https://t.me/cvenotify/34322 · Telegram Post