GHSA-wp4m-7hpj-8qp8

Source

https://github.com/advisories/GHSA-wp4m-7hpj-8qp8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-wp4m-7hpj-8qp8/GHSA-wp4m-7hpj-8qp8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wp4m-7hpj-8qp8

Withdrawn

2025-12-02T00:28:45Z

Published

2024-01-20T00:30:27Z

Modified

2025-12-02T01:32:19Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Duplicate Advisory: Discovery uses the same AES/GCM Nonce throughout the session

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-w3hj-wr2q-x83g. This link is maintained to preserve external references.

Original Description

Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed.

Database specific

{
    "cwe_ids": [
        "CWE-323",
        "CWE-330"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-02T00:28:45Z",
    "nvd_published_at": "2024-01-19T22:15:08Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / tech.pegasys.discovery:discovery

Package

Name: tech.pegasys.discovery:discovery; View open source insights on deps.dev
Purl: pkg:maven/tech.pegasys.discovery/discovery

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-wp4m-7hpj-8qp8/GHSA-wp4m-7hpj-8qp8.json"