CVE-2022-23004CWE-703CWE-707

Algorithm incorrectly returning error and Invalid unreduced value written to output buffer

Medium · published July 29, 2022

CVSS v3.1
5.3
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the library, and an invalid unreduced value is written to the output buffer. This may be leveraged by an attacker to cause an error scenario, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00720 · 53.4th percentile
Weaknesses
CWE-703 · Improper Check or Handling of Exceptional Conditions; CWE-707 · Improper Neutralization
Published
2022-07-29T18:55Z
EPSS history
Timeline
  • 29 JUL 18:55Z
    Algorithm incorrectly returning error and Invalid unreduced value written to output buffer
    cvelistv5