GitHub Advisoryadvisory · npm

GHSA-49q7-c7j4-3p7m Elliptic allows BER-encoded signatures

LOW Published 2024-08-02 Modified 2025-11-04 Official page ↗

Aliases: CVE-2024-42461
Ecosystem: npm
Packages: elliptic
Severity: Low
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses: CWE-347
Reviewed: 2024-08-05

Affected packages

• npm elliptic: >= 5.2.1, < 6.5.7 → fixed in 6.5.7

Description

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Related

Alias · CVE (1)

CVE-2024-42461 In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed. vulnerability

Weakness · CWE (1)

CWE-347 Improper Verification of Cryptographic Signature weakness

References