x/vulndb: potential Go vuln in github.com/free5gc/udm: CVE-2023-46324

[GoVulnBot]

CVE-2023-46324 references github.com/free5gc/udm, which may be a Go module.

Description:
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its private key and the attacker's public key.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-46324
• JSON: https://github.com/CVEProject/cvelist/tree/99983d75f0a98b6c70bdde2f126262c85c4ebacf/2023/46xxx/CVE-2023-46324.json
• fix: Prevent Invalid Curve Attack on 5G SUCI Feature free5gc/udm#20
• web: free5gc/udm@v1.1.1...v1.2.0
• Imported by: https://pkg.go.dev/github.com/free5gc/udm?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/free5gc/udm
      vulnerable_at: 1.1.1
      packages:
        - package: n/a
cves:
    - CVE-2023-46324
references:
    - fix: https://github.com/free5gc/udm/pull/20
    - web: https://github.com/free5gc/udm/compare/v1.1.1...v1.2.0

[gopherbot]

Change https://go.dev/cl/537395 mentions this issue: data/excluded: batch add 18 excluded reports

[gopherbot]

Change https://go.dev/cl/592763 mentions this issue: data/reports: unexclude 75 reports