Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sweet-B Library: Point compress/decompress using the wrong bit for sign
Vulnerability Description
When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with user level privileges and no other user's assistance can exploit this vulnerability with only knowledge of the public key and the library. The resulting output may cause an error when used in other operations; for instance, verification of a valid signature under a decompressed public key may fail. This may be leveraged by an attacker to cause an error scenario in applications which use the library, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability Type
数值计算不正确
Vulnerability Title
Western Digital Sweet B 安全漏洞
Vulnerability Description
Western Digital Sweet B是美国Western Digital公司的一个使用 NIST P-256 和 SECG secp256k1 曲线实现公钥椭圆曲线加密 (ECC) 的库。 Western Digital Sweet B library存在安全漏洞，该漏洞源于压缩或解压缩椭圆曲线点时，使用了错误的符号位选择。具有用户级别特权且没有其他用户帮助的攻击者可以在只知道公钥和库的情况下利用此漏洞。攻击者可能利用该漏洞在使用该库的应用程序中造成错误场景，从而对单个用户造成有限的拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A