CVE-2023-24533

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-682

Affected software

Vendor	Product	Versions
filippo.io/nistec	filippo.io/nistec	< 0.0.2

References

https://github.com/FiloSottile/nistec/commit/c58aa1223ccf3943513e1e661cebce95af137244Patch
https://go.dev/issue/58647Issue Tracking, Patch
https://pkg.go.dev/vuln/GO-2023-1595Third Party Advisory
https://github.com/FiloSottile/nistec/commit/c58aa1223ccf3943513e1e661cebce95af137244Patch
https://go.dev/issue/58647Issue Tracking, Patch
https://pkg.go.dev/vuln/GO-2023-1595Third Party Advisory

Timeline

Published: Mar 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-245347.5HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of servic CVE-2023-245357.5Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more CVE-2023-245367.5Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This CVE-2023-245377.5Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loo CVE-2023-245389.8Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, si CVE-2023-245397.3Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated CVE-2023-24547.2schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacke CVE-2023-245409.8Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the ch CVE-2023-245426.7Unquoted search path or element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user t CVE-2023-245448.1Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product.CVE-2023-245457.5On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service att CVE-2023-245468.1On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicio