{"action":"Upgrade github.com/ecies/go/v2 to 2.0.8 or later.","affected":[{"fixed":"2.0.8","introduced":"0"}],"component":"github.com/ecies/go/v2","cve_ids":["CVE-2023-49292"],"ecosystem":"Go","epss":0.00335,"exploited":false,"fixed_versions":["2.0.8"],"ghsa_id":"GHSA-8j98-cjfr-qx3h","id":"tcs_01M5KF3WRP2P97YP23E1VE9K23","modified_at":"2023-12-11T15:56:20.742463Z","published_at":"2023-12-05T23:30:56Z","references":["https://osv.dev/vulnerability/GHSA-8j98-cjfr-qx3h","https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3h","https://nvd.nist.gov/vuln/detail/CVE-2023-49292","https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebd","https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md","https://github.com/ecies/go","https://github.com/ecies/go/releases/tag/v2.0.8"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-8j98-cjfr-qx3h","url":"https://osv.dev/vulnerability/GHSA-8j98-cjfr-qx3h"}],"summary":"github.com/ecies/go vulnerable to possible private key restoration"}