CVE-2023-24532: Incorrect calculation on P256 curves in crypto/internal/nistec
Incorrect calculation on P256 curves in crypto/internal/nistec
Other sources
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Go 1.20.2 and Goto a version that resolves this vulnerability.Fixed in 1.19.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.21.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-24532?
The severity of CVE-2023-24532 is medium with a severity value of 5.3.
Which software versions are affected by CVE-2023-24532?
The affected software versions for CVE-2023-24532 are Go 1.20.2 and Go versions up to 1.19.7.
How does CVE-2023-24532 impact crypto/ecdsa and crypto/ecdh usages?
CVE-2023-24532 does not impact usages of crypto/ecdsa or crypto/ecdh.
What is the recommended remedy for CVE-2023-24532?
The recommended remedy for CVE-2023-24532 is to update to Go version 1.19.7 or apply the provided fix from Red Hat.
Are there any public references for CVE-2023-24532?
Yes, you can find public references for CVE-2023-24532 at the following URLs: <br> - [https://go.dev/cl/471255](https://go.dev/cl/471255) <br> - [https://pkg.go.dev/vuln/GO-2023-1621](https://pkg.go.dev/vuln/GO-2023-1621) <br> - [https://groups.google.com/g/golang-announce/c/3-TpUx48iQY](https://groups.google.com/g/golang-announce/c/3-TpUx48iQY)