{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"tech.pegasys.discovery:discovery","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThan":"0.4.5","status":"affected","version":"0","versionType":"maven"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"tech.pegasys.discovery:discovery","product":"tech.pegasys.discovery:discovery","source":"OSV GHSA-w3hj-wr2q-x83g","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"0.4.5"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2024-23688","cwes":["CWE-323"],"description":"Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed.","epss":{"date":"2026-11-08","percentile":0.42638,"score":0.00493},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1794146403541,"publishedAt":1705699595282,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/ConsenSys/discovery/security/advisories/GHSA-w3hj-wr2q-x83g"},{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/advisories/GHSA-w3hj-wr2q-x83g"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x83g"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://github.com/ConsenSys/discovery/security/advisories/GHSA-w3hj-wr2q-x83g"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://github.com/advisories/GHSA-w3hj-wr2q-x83g"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x83g"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-w3hj-wr2q-x83g"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-w3hj-wr2q-x83g"}],"remediation":[{"kind":"fix","source":"OSV GHSA-w3hj-wr2q-x83g","text":"tech.pegasys.discovery:discovery (Maven): OSV reports a fixed version 0.4.5. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-w3hj-wr2q-x83g"}],"revision":"ec1ec33fa45d7ebc9a248e9f9ab254c18d41f5eecf81cfb605e685694838fd6f","sources":[{"modifiedAt":1794146403541,"name":"CNA: VulnCheck","retrievedAt":1794146944308,"url":"https://www.cve.org/CVERecord?id=CVE-2024-23688"},{"modifiedAt":1783493592584,"name":"OSV / GitHub Security Advisories","retrievedAt":1794146944793,"url":"https://osv.dev/vulnerability/GHSA-w3hj-wr2q-x83g"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150557858,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23688"}],"ssvc":{"assessedAt":1705938315449,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Consensys Discovery Nonce Reuse","updatedAt":1794150557858}