GitHub Advisoryadvisory · npm

GHSA-p2hp-3wv3-4w74 ecdh vulnerable to Exposure of Resource to Wrong Sphere

HIGH Published 2023-02-24 Modified 2023-03-08 Official page ↗
Aliases
CVE-2022-44310
Ecosystem
npm
Packages
ecdh
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-668
Reviewed
2023-03-08

Affected packages

• npm ecdh: < 0.2.0 → fixed in 0.2.0

Description

In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.

Related

Alias · CVE (1)

  • CVE-2022-44310 In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived… vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References