PT-2017-10866
CVE-2017-1000168
·
Published
2017-01-26
·
Updated
2021-08-25
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
sodiumoxide versions 0.0.13 and older
Description
The issue concerns the
scalarmult() function, which accepted all-zero public keys. This results in the Diffie-Hellman shared secret always being zero, regardless of the private key used.Recommendations
For sodiumoxide versions 0.0.13 and older, update to a version that includes the fix for the
scalarmult() function, which now checks for and rejects all-zero public keys. Found an issue in the description? Have something to add? Feel free to write us 👾