CVE-2024-26317

Katalog CVE

CVSS 6.1 · Medium EPSS 0,19%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm. Skor CVSS 3.1 6.1 (Medium) menurut CISA ADP.

Deskripsi (NVD)

In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates, causing the algorithm to yield a result of POINT_AT_INFINITY when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret.

Rincian

Terbit di NVD

27 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.1 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://drive.google.com/file/d/1aGLAFz20-fc7ZLiWouegyK_65jCkGTDb/view?usp=sharing
• https://github.com/illumos/illumos-gate
• https://rashidkhanpathan.github.io/posts/CVE-2024-26317-Elliptic-curve-point-addition-error/