| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/ecies/go/v2 | < 2.0.8 | 2.0.8 |
| go | < 2.0.8 | 2.0.8 |
If functions Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, he could recover any private key that he interacts with.
Patched in v2.0.8
You could manually check public key by calling IsOnCurve() function from secp256k1 libraries.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free