Skip to content
Fencer Vulns
medium 4.9

CVE-2023-49292 json

Possible private key restoration in go package github.com/ecies/go

published 2023-12-04 2 y ago modified 2026-06-17 4 mo ago also GHSA-8j98-cjfr-qx3h , GO-2023-2380 , EUVD-2023-3162

cvss
4.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.

Patch / fix

  • go github.com/ecies/go/v2 2.0.8
  • ecies go 2.0.8
  • golang CBL-Mariner 2.0 1.21.6-1
  • golang Azure Linux 3.0 1.20.7-1

azure linux advisories AZL-37343AZL-37392AZL-58246

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/ecies/go/v2
<2.0.8
2.0.8

Affected products

  • ecies go

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.