description: A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.
problem types: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
product: opencryptoki
vendor: n/a
versions:
status: affected, version: Fixed in v3.17.0
}