Incorrect calculation in Go programming language - CVE-2023-24532
Published: March 13, 2023
Vulnerability identifier: #VU73264
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2023-24532
CWE-ID: CWE-682
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Google
Affected software:
Go programming language
Go programming language
Detailed vulnerability description
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars.
How to mitigate CVE-2023-24532
Install updates from vendor's website.