~ / search / GHSA-p2hp-3wv3-4w74

GHSA-p2hp-3wv3-4w74

ecdh vulnerable to Exposure of Resource to Wrong Sphere

Source: GitHub Advisory Database (reviewed) High CVE-2022-44310

Packages

EcosystemPackageAffectedFixed in
npm ecdh < 0.2.0 0.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.

References

External links from the advisory. They lead to third-party sites.