CVE-2017-1000168
scalarmult() vulnerable to degenerate public keys
sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys
- Record
CVE-2017-1000168- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys
- Record
CVE-2017-1000168- Updated
- 2026-11-02
EUVDEUVD-2021-1520 No score
sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys
- Record
EUVD-2021-1520- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2wc6-2rcj-8v76
scalarmult() vulnerable to degenerate public keys
The scalarmult() function included in previous versions of this crate accepted all-zero public keys, for which the resulting Diffie-Hellman shared secret will always be zero regardless of the private key used.
This issue was fixed by checking for this class of keys and rejecting them if they are used.
- Record
GHSA-2wc6-2rcj-8v76- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-1240
- Updated
- 2026-11-02
OSVGHSA-2wc6-2rcj-8v76
scalarmult() vulnerable to degenerate public keys
The scalarmult() function included in previous versions of this crate accepted all-zero public keys, for which the resulting Diffie-Hellman shared secret will always be zero regardless of the private key used.
This issue was fixed by checking for this class of keys and rejecting them if they are used.
- Record
GHSA-2wc6-2rcj-8v76- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-1240
- Updated
- 2026-11-02
OSVRUSTSEC-2017-0001
scalarmult() vulnerable to degenerate public keys
The scalarmult() function included in previous versions of this crate
accepted all-zero public keys, for which the resulting Diffie-Hellman shared
secret will always be zero regardless of the private key used.
This issue was fixed by checking for this class of keys and rejecting them if they are used.
- Record
RUSTSEC-2017-0001- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sodiumoxidecrates.io |
before 0.0.14 | 0.0.14 |
sodiumoxidecrates.io |
0.0.0-0 up to 0.0.14 | 0.0.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-1000168 is a medium vulnerability (CVSS 6.5) in Sodiumoxide Project Sodiumoxide, published January 26, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in sodiumoxide 0.0.14.
References
github.com/dnaq/sodiumoxide/issues/154
nvd.nist.gov/vuln/detail/CVE-2017-1000168
rustsec.org/advisories/RUSTSEC-2017-0001.html
crates.io/crates/sodiumoxide