Advisory Database
  • Advisories
  • Dependency Scanning
  1. maven
  2. ›
  3. tech.pegasys.discovery/discovery
  4. ›
  5. CVE-2024-23688

CVE-2024-23688: Discovery uses the same AES/GCM Nonce throughout the session

April 6, 2021 (updated December 2, 2025)

Discovery uses the same AES/GCM Nonce throughout the session though it should be generated on per message basis which can lead to the leaking of the session key. As the actual ENR record is signed with a different key it is not possible for an attacker to alter the ENR record. Note that the node private key is not compromised, only the session key generated to communicate with an individual peer.

References

  • github.com/ConsenSys/discovery
  • github.com/ConsenSys/discovery/security/advisories/GHSA-w3hj-wr2q-x83g
  • github.com/advisories/GHSA-w3hj-wr2q-x83g
  • nvd.nist.gov/vuln/detail/CVE-2024-23688
  • vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x83g

Code Behaviors & Features

Detect and mitigate CVE-2024-23688 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.4.5

Fixed versions

  • 0.4.5

Solution

Upgrade to version 0.4.5 or above.

Impact 5.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Learn more about CVSS

Weakness

  • CWE-323: Reusing a Nonce, Key Pair in Encryption
  • CWE-330: Use of Insufficiently Random Values

Source file

maven/tech.pegasys.discovery/discovery/CVE-2024-23688.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 10 Dec 2025 00:18:47 +0000.