PT-2023-14449 · Unknown · In Development Il Ecdh

Shilohshio · Published 2023-02-24 · Updated 2025-03-12 · CVE-2022-44310

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions In Development IL ecdh versions prior to 0.2.0

Description An attacker can send an invalid point, not on the curve, as the public key and obtain the derived shared secret. This issue allows an attacker to potentially exploit the system by manipulating the public key exchange process.

Recommendations For versions prior to 0.2.0, update to version 0.2.0 or later to resolve the issue. As a temporary workaround, consider implementing additional validation on public keys to ensure they are valid points on the curve before deriving the shared secret.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2022-44310

GHSA-P2HP-3WV3-4W74

Affected Products

In Development Il Ecdh

References · 10

• 🔥 https://github.com/developmentil/ecdh/issues/3 · Exploit
• https://osv.dev/vulnerability/CVE-2022-44310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44310 · Security Note
• https://osv.dev/vulnerability/GHSA-p2hp-3wv3-4w74 · Vendor Advisory
• https://github.com/developmentil/ecdh/pull/4 · Note
• https://github.com/developmentil/ecdh · Note
• https://github.com/developmentil/ecdh/commit/ef4560e7233f4e8107a17a77bc540121599c78fa · Note
• https://t.me/cvenotify/114479 · Telegram Post
• https://t.me/cibsecurity/58889 · Telegram Post
• https://t.me/cvenotify/45693 · Telegram Post