GitHub Advisoryadvisory · npm

GHSA-vh7m-p724-62c2 Signature Malleabillity in elliptic

HIGH Published 2020-07-29 Modified 2024-10-16 Official page ↗
Aliases
CVE-2020-13822
Ecosystem
npm
Packages
elliptic
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-190
Reviewed
2020-07-29

Affected packages

• npm elliptic: < 6.5.3 → fixed in 6.5.3

Description

The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Related

Alias · CVE (1)

  • CVE-2020-13822 The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer… vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References