{"action":"Upgrade github.com/ecies/go/v2 to 2.0.8 or later.","affected":[{"fixed":"2.0.8","introduced":"0"}],"component":"github.com/ecies/go/v2","cve_ids":["CVE-2023-49292"],"ecosystem":"Go","epss":0.00335,"exploited":false,"fixed_versions":["2.0.8"],"ghsa_id":"GHSA-8j98-cjfr-qx3h","id":"tcs_01M5KG0QTXVJT87NBFRZ9A1VPA","modified_at":"2024-05-20T16:03:47Z","published_at":"2023-12-11T15:30:30Z","references":["https://osv.dev/vulnerability/GO-2023-2380","https://github.com/ecies/go/security/advisories/GHSA-8j98-cjfr-qx3h","https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebd","https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2023-2380","url":"https://osv.dev/vulnerability/GO-2023-2380"}],"summary":"Private key recovery via invalid curve point in github.com/ecies/go/v2"}