CVE-2024-42461 — Improper Verification of Cryptographic Signature in Node-elliptic

CWE-347 — Improper Verification of Cryptographic Signature7 documents6 sources
Severity
9.1CRITICALNVD
EPSS
2.9%
top 13.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Debian Node-ellipticIndutny EllipticElliptic Project Elliptic+4 more
Timeline
PublishedAug 2
Latest updateAug 13

Description

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages7 packages

▶debiandebian/node-elliptic< node-elliptic 6.5.7+dfsg-1 (forky)
▶npmindutny/elliptic5.2.1 — 6.5.7

Patches

Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
Elliptic allows BER-encoded signatures↗2024-08-02
▶
OSV
CVE-2024-42461: In the Elliptic package 6↗2024-08-02
▶
OSV
Elliptic allows BER-encoded signatures↗2024-08-02
▶

📋Vendor Advisories

3
Microsoft
In the Elliptic package 6.5.6 for Node.js ECDSA signature malleability occurs because BER-encoded signatures are allowed.↗2024-08-13
▶
Red Hat
elliptic: nodejs/elliptic: ECDSA implementation malleability due to BER-enconded signatures being allowed↗2024-08-02
▶
Debian
CVE-2024-42461: node-elliptic - In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs b...↗2024
▶