pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its private key and the attacker's public key.
References
Link | Resource |
---|---|
https://github.com/free5gc/udm/compare/v1.1.1...v1.2.0 | Product |
https://github.com/free5gc/udm/pull/20 | Patch Third Party Advisory |
https://www.gsma.com/security/wp-content/uploads/2023/10/0073-invalid_curve.pdf |
Configurations
Configuration 1 (hide)
AND |
|
History
09 Jan 2024, 14:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
30 Oct 2023, 13:46
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
CPE | cpe:2.3:a:free5gc:udm:*:*:*:*:*:go:*:* cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* |
|
References | (MISC) https://github.com/free5gc/udm/pull/20 - Patch, Third Party Advisory | |
References | (MISC) https://github.com/free5gc/udm/compare/v1.1.1...v1.2.0 - Product | |
First Time |
Free5gc udm
Golang Free5gc Golang go |
|
CWE | CWE-347 |
23 Oct 2023, 01:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-10-23 01:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-46324
Mitre link : CVE-2023-46324
CVE.ORG link : CVE-2023-46324
JSON object : View
Products Affected
free5gc
- udm
golang
- go
CWE
CWE-347
Improper Verification of Cryptographic Signature