PT-2022-15773 · Western Digital+1 · Sweet B Library+1

Published 2022-07-29 · Updated 2022-08-05 · CVE-2022-23004

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the library, and an invalid unreduced value is written to the output buffer. This may be leveraged by an attacker to cause an error scenario, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Neutralization

Weakness Enumeration

CWE-707

CWE-682

CWE-703

Related Identifiers

CVE-2022-23004

Affected Products

Sweet B Library

Sweet B

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-23004 · Security Note
• https://westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23004 · Vendor Advisory
• https://t.me/cvenotify/34324 · Telegram Post
• https://t.me/cibsecurity/47280 · Telegram Post