~ / search / GHSA-49q7-c7j4-3p7m

GHSA-49q7-c7j4-3p7m

Elliptic allows BER-encoded signatures

Source: GitHub Advisory Database (reviewed) Low CVE-2024-42461

Packages

EcosystemPackageAffectedFixed in
npm elliptic >= 5.2.1, < 6.5.7 6.5.7

Details

As written in the advisory (Markdown source, shown as plain text).

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

References

External links from the advisory. They lead to third-party sites.