tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir

Description

Private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is buffer package

Recommendation

Update the tiny-secp256k1 package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.1.6
• Patched version(s): 1.1.7

References

• GHSA-7mc2-6phr-23xc
• CVE-2024-49364
• CWE-522
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• tiny-secp256k1 allows for verify() bypass when running in bundled environment - CVE-2024-49365
• secp256k1-node allows private key extraction over ECDH - CVE-2024-48930
• Nuxt vulnerable to remote code execution via the browser when running the test locally - CVE-2024-34344
• webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle - CVE-2024-43373

Tags:

npm

tiny-secp256k1