id: GO-2023-2163
modules:
    - module: github.com/nats-io/nkeys
      versions:
        - introduced: 0.4.0
          fixed: 0.4.6
      vulnerable_at: 0.4.5
      packages:
        - package: github.com/nats-io/nkeys
          symbols:
            - decodePubCurveKey
          derived_symbols:
            - ckp.Open
            - ckp.Seal
            - ckp.SealWithRand
summary: Curve KeyPairs fail to encrypt in github.com/nats-io/nkeys
description: |-
    Curve KeyPairs always use the same (all-zeros) key to encrypt data, and provide
    no security.
cves:
    - CVE-2023-46129
ghsas:
    - GHSA-mr45-rx8q-wcm9
credits:
    - Quentin Matillat (GitHub @tinou98)
references:
    - advisory: https://github.com/nats-io/nkeys/security/advisories/GHSA-mr45-rx8q-wcm9
    - fix: https://github.com/nats-io/nkeys/commit/58fb9d69f42ea73fffad1d14e5914dc666f3daa1