Vulnerability identifier: #VU73264
Vulnerability risk: High
CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-682
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Go programming language
Universal components / Libraries /
Scripting languages
Vendor: Google
Description
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Go programming language: 1.19 - 1.19.6, 1.20 - 1.20.1
External links
http://go.dev/cl/471255
http://pkg.go.dev/vuln/GO-2023-1621
http://groups.google.com/g/golang-announce/c/3-TpUx48iQY
http://go.dev/issue/58647
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.