CVE-2023-24532: Incorrect calculation on P256 curves in crypto/internal/nistec
First published: Wed Mar 08 2023(Updated: )
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.
Credit: security@golang.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Golang Go | <1.19.7 | |
| Golang Go | >=1.20.0<1.20.2 | |
| redhat/Go 1.20.2 and Go | <1.19.7 | 1.19.7 |
Remedy
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://go.dev/cl/471255
- https://go.dev/issue/58647
- https://groups.google.com/g/golang-announce/c/3-TpUx48iQY
- https://pkg.go.dev/vuln/GO-2023-1621
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2223364
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2223365
- https://access.redhat.com/errata/RHSA-2023:4627
- https://access.redhat.com/errata/RHSA-2023:4657
- https://access.redhat.com/errata/RHSA-2023:4892
- https://access.redhat.com/errata/RHSA-2023:5314
- https://access.redhat.com/errata/RHSA-2023:5935
- https://access.redhat.com/errata/RHSA-2023:5976
- https://access.redhat.com/errata/RHSA-2023:5947
- https://bugzilla.redhat.com/show_bug.cgi?id=2223355
Frequently Asked Questions
What is the severity of CVE-2023-24532?
The severity of CVE-2023-24532 is medium with a severity value of 5.3.
Which software versions are affected by CVE-2023-24532?
The affected software versions for CVE-2023-24532 are Go 1.20.2 and Go versions up to 1.19.7.
How does CVE-2023-24532 impact crypto/ecdsa and crypto/ecdh usages?
CVE-2023-24532 does not impact usages of crypto/ecdsa or crypto/ecdh.
What is the recommended remedy for CVE-2023-24532?
The recommended remedy for CVE-2023-24532 is to update to Go version 1.19.7 or apply the provided fix from Red Hat.
Are there any public references for CVE-2023-24532?
Yes, you can find public references for CVE-2023-24532 at the following URLs: <br> - [https://go.dev/cl/471255](https://go.dev/cl/471255) <br> - [https://pkg.go.dev/vuln/GO-2023-1621](https://pkg.go.dev/vuln/GO-2023-1621) <br> - [https://groups.google.com/g/golang-announce/c/3-TpUx48iQY](https://groups.google.com/g/golang-announce/c/3-TpUx48iQY)
- collector/nvd-index
- agent/references
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/author
- agent/weakness
- agent/severity
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-24532
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/event
- agent/tags
- agent/first-publish-date
- vendor/golang
- canonical/golang go
- version/golang go/1.20.0
- package-manager/redhat