CVE-2022-23806
Description
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
Risk Information
Base Score
9.1
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS Score
Exploitation Probability
0.024
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| (RHSA-2022:1819) go-toolset:rhel8 security and bug fix update delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64.rpm | Linux |
| (RHSA-2022:1819) go-toolset:rhel8 security and bug fix update delve-debugsource-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64.rpm | Linux |
| (RHSA-2022:1819) go-toolset:rhel8 security and bug fix update go-toolset-1.17.7-1.module+el8.6.0+14297+32a15e19.x86_64.rpm | Linux |
| (RHSA-2022:1819) go-toolset:rhel8 security and bug fix update golang-1.17.7-1.module+el8.6.0+14297+32a15e19.x86_64.rpm | Linux |
| (RHSA-2022:1819) go-toolset:rhel8 security and bug fix update golang-bin-1.17.7-1.module+el8.6.0+14297+32a15e19.x86_64.rpm | Linux |
| (RHSA-2022:1819) go-toolset:rhel8 security and bug fix update golang-docs-1.17.7-1.module+el8.6.0+14297+32a15e19.noarch.rpm | Linux |
| (RHSA-2022:1819) go-toolset:rhel8 security and bug fix update golang-misc-1.17.7-1.module+el8.6.0+14297+32a15e19.noarch.rpm | Linux |
| (RHSA-2022:1819) go-toolset:rhel8 security and bug fix update golang-race-1.17.7-1.module+el8.6.0+14297+32a15e19.x86_64.rpm | Linux |
| (RHSA-2022:1819) go-toolset:rhel8 security and bug fix update golang-src-1.17.7-1.module+el8.6.0+14297+32a15e19.noarch.rpm | Linux |
| (RHSA-2022:1819) go-toolset:rhel8 security and bug fix update golang-tests-1.17.7-1.module+el8.6.0+14297+32a15e19.noarch.rpm | Linux |
| SUSE-SU-2023:0600-1(Public Cloud Module 15-SP4 ) google-guest-agent-20230221.00-150000.1.34.1.x86_64.rpm | Linux |
| SUSE-SU-2023:0600-1(Public Cloud Module 15-SP3 ) google-guest-agent-20230221.00-150000.1.34.1.x86_64_15_SP3.rpm | Linux |
| SUSE-SU-2023:0602-1(Public Cloud Module 15-SP4 ) google-osconfig-agent-20230222.00-150000.1.27.1.x86_64.rpm | Linux |
| SUSE-SU-2023:0602-1(Public Cloud Module 15-SP3 ) google-osconfig-agent-20230222.00-150000.1.27.1.x86_64_15_SP3.rpm | Linux |
| SUSE-SU-2023:0794-1(Basesystem Module 15-SP4 ) python3-PyJWT-2.4.0-150200.3.6.2.noarch.rpm | Linux |
| golang Security Update (ALAS2023-2023-048) golang-1.19.3-2.amzn2023.0.2.x86_64.rpm | Linux |
| golang Security Update (ALAS2023-2023-048) golang-bin-1.19.3-2.amzn2023.0.2.x86_64.rpm | Linux |
| golang Security Update (ALAS2023-2023-048) golang-docs-1.19.3-2.amzn2023.0.2.noarch.rpm | Linux |
| golang Security Update (ALAS2023-2023-048) golang-misc-1.19.3-2.amzn2023.0.2.noarch.rpm | Linux |
| golang Security Update (ALAS2023-2023-048) golang-race-1.19.3-2.amzn2023.0.2.x86_64.rpm | Linux |
| golang Security Update (ALAS2023-2023-048) golang-shared-1.19.3-2.amzn2023.0.2.x86_64.rpm | Linux |
| golang Security Update (ALAS2023-2023-048) golang-src-1.19.3-2.amzn2023.0.2.noarch.rpm | Linux |
| golang Security Update (ALAS2023-2023-048) golang-tests-1.19.3-2.amzn2023.0.2.noarch.rpm | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234