—
GO-2023-2380
Private key recovery via invalid curve point in github.com/ecies/go/v2
Quick fix
GO-2023-2380 — github.com/ecies/go/v2: upgrade to the fixed version with the command below.
go get github.com/ecies/go/v2@v2.0.8Details
An attacker may be able to recover private keys due to a bug in the ECDH function.
The library does not check whether the provided public key is on the curve, which means that an attacker can create a public key that is not on the curve and use it to recover the private key.
A workaround is to manually check that the public key is valid by calling the IsOnCurve function from the secp256k1 libraries.
Are you affected?
Enter the version of the package you're using.