Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-23688

Good to know:

icon

Date: January 19, 2024

Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed.

Language: Java

Severity Score

Related Resources (5)

https://github.com/ConsenSys/discovery/security/advisories/GHSA-w3hj-wr2q-x83g
https://nvd.nist.gov/vuln/detail/CVE-2024-23688
https://github.com/advisories/GHSA-w3hj-wr2q-x83g
https://vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x83g
https://www.mend.io/vulnerability-database/CVE-2024-23688

Severity Score

Weakness Type (CWE)

Use of Insufficiently Random Values

CWE-330

Reusing a Nonce, Key Pair in Encryption

CWE-323

Top Fix

icon

Upgrade Version

Upgrade to version 0.4.5

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us