ghsa-vh7m-p724-62c2
Vulnerability from github
Published
2020-07-29 20:40
Modified
2021-09-23 17:39
Severity
Summary
Signature Malleabillity in elliptic
Details
The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
{
"affected": [
{
"ecosystem_specific": {
"affected_functions": [
"(elliptic).ec"
]
},
"package": {
"ecosystem": "npm",
"name": "elliptic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.5.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-13822"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": true,
"github_reviewed_at": "2020-07-29T20:39:31Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading \u0027\\0\u0027 bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.",
"id": "GHSA-vh7m-p724-62c2",
"modified": "2021-09-23T17:39:58Z",
"published": "2020-07-29T20:40:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13822"
},
{
"type": "WEB",
"url": "https://github.com/indutny/elliptic/issues/226"
},
{
"type": "WEB",
"url": "https://github.com/indutny/elliptic/commit/856fe4d99fe7b6200556e6400b3bf585b1721bec"
},
{
"type": "PACKAGE",
"url": "https://github.com/indutny/elliptic"
},
{
"type": "WEB",
"url": "https://medium.com/@herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/elliptic"
},
{
"type": "WEB",
"url": "https://yondon.blog/2019/01/01/how-not-to-use-ecdsa"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Signature Malleabillity in elliptic"
}
Loading...