cve.bz

CVE-2023-49292

4.8 mediumEPSS 0.3%

Medium (4.8) in ecies go. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/ecies/go/v2 2.0.8.

ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.

Severity

CVSS 3.1

4.8 medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWE
CWE-200
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-8j98-cjfr-qx3hGogithub.com/ecies/go/v2<2.0.82.0.8
GO-2023-2380Gogithub.com/ecies/go/v2<2.0.82.0.8

References

Check your stackJSON