CVE-2023-49292

    Dashboard / Vulnerabilities / CVE-2023-49292

    CVE-2023-49292

    Published: 4 Dec 2023Last Modified: 28 Oct 2026

    Summary: Possible private key restoration in go package github.com/ecies/go

    Details: ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.

    References: https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md, https://github.com/ecies/go/releases/tag/v2.0.8, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49292.json, https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3h, https://nvd.nist.gov/vuln/detail/CVE-2023-49292, https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebd

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c6e775163866d6ea5233eb8ec8530a9122101ebd

    Affected versions

    v2.0.7
    v2.0.6
    v2.0.5
    v2.0.4
    v2.0.3
    v2.0.2
    v2.0.1
    v2.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-49292 | CVE-DB