CVE-2024-23688

Published: Jan 19, 2024Modified: Jul 14, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed.

Affected (1)

Products: Consensys: Discovery

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Consensys Discovery	Before 0.4.5

Related CWEs

Reusing a Nonce, Key Pair in Encryption

Nonces should be used for the present occasion and only once.

Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

References (6)

https://github.com/ConsenSys/discovery/security/advisories/GHSA-w3hj-wr2q-x83g

Source: disclosure@vulncheck.com

Vendor Advisory

https://github.com/advisories/GHSA-w3hj-wr2q-x83g

Source: disclosure@vulncheck.com

Third Party Advisory

https://vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x83g

Source: disclosure@vulncheck.com

Third Party Advisory

https://github.com/ConsenSys/discovery/security/advisories/GHSA-w3hj-wr2q-x83g

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/advisories/GHSA-w3hj-wr2q-x83g

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x83g

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.