github.com/ecies/go vulnerable to possible private key restoration
Date: 2023-12
Affected: go/github.com/ecies/go/v2
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-49292
CWE: CWE-200
CVSS: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

### Impact If functions `Encapsulate()`, `Decapsulate()` and `ECDH()` could be called by an attacker, he could recover any private key that he interacts with. ### Patches Patched in v2.0.8 ### Workarounds You could manually check public key by calling `IsOnCurve()` function from secp256k1 libraries. ### References https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md


Mitigations:

Architectural layers (MAESTRO):