Description
The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading ‘\0’ bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Recommendation
Update the elliptic package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.5.3
- Patched version(s): 6.5.3
References
Could your website be exposed too?
SmartScanner can check your website for Signature Malleabillity in elliptic and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Elliptic's EDDSA missing signature length check - CVE-2024-42459
- ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign - CVE-2020-14966
- RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign - CVE-2020-14968
- Elliptic Uses a Broken or Risky Cryptographic Algorithm - CVE-2020-28498
You might also like:
See something that needs correcting? Let us knowUpdated October 16, 2024