CVE-2022-44310

In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret

High · published February 24, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
51.2
In the wild
Unconfirmed
What it is

In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00666 · 51.2th percentile
Published
2023-02-24T00:00Z
EPSS history
Timeline
  • 24 FEB 00:00Z
    In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret
    cvelistv5