secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery

Description

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.

Recommendation

Update the @lionello/secp256k1-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.0
• Patched version(s): 1.1.0

References

• GHSA-q3f4-9h4p-vgr3
• www.npmjs.com
• CVE-2022-41340
• CWE-347
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• JWS and JWT signature validation vulnerability with special characters - CVE-2022-25898
• ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign - CVE-2020-14966
• Leading white space bypasses protocol validation - CVE-2022-24723
• parse-server auth adapter app ID validation can be circumvented - CVE-2022-39231

Tags:

npm

@lionello/secp256k1-js