mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 17:21:36 +00:00
105 lines
3.0 KiB
JSON
105 lines
3.0 KiB
JSON
{
|
|
"id": "CVE-2024-23688",
|
|
"sourceIdentifier": "disclosure@vulncheck.com",
|
|
"published": "2024-01-19T22:15:08.563",
|
|
"lastModified": "2024-01-26T15:53:31.397",
|
|
"vulnStatus": "Analyzed",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed.\n\n"
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Las versiones de Consensys Discovery inferiores a 0.4.5 utilizan el mismo nonce AES/GCM durante toda la sesi\u00f3n que idealmente deber\u00eda ser \u00fanico para cada mensaje. La clave privada del nodo no est\u00e1 comprometida, solo se expone la clave de sesi\u00f3n generada para una comunicaci\u00f3n entre pares espec\u00edfica."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 5.3,
|
|
"baseSeverity": "MEDIUM"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 1.4
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-330"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"source": "disclosure@vulncheck.com",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-323"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:consensys:discovery:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "0.4.5",
|
|
"matchCriteriaId": "33F278C7-2BA2-400A-AB54-C1CC096B8D31"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://github.com/ConsenSys/discovery/security/advisories/GHSA-w3hj-wr2q-x83g",
|
|
"source": "disclosure@vulncheck.com",
|
|
"tags": [
|
|
"Vendor Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://github.com/advisories/GHSA-w3hj-wr2q-x83g",
|
|
"source": "disclosure@vulncheck.com",
|
|
"tags": [
|
|
"Third Party Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x83g",
|
|
"source": "disclosure@vulncheck.com",
|
|
"tags": [
|
|
"Third Party Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |