CVE-2024-23688CWE-323
Consensys Discovery Nonce Reuse
Medium · published January 19, 2024
What it is
Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00493 · 41.4th percentile
- Weakness
- CWE-323 · Reusing a Nonce, Key Pair in Encryption
- Published
- 2024-01-19T21:26Z
EPSS history
Timeline