~ / search / GHSA-vh7m-p724-62c2

GHSA-vh7m-p724-62c2

Signature Malleabillity in elliptic

Source: GitHub Advisory Database (reviewed) High CVE-2020-13822

Packages

EcosystemPackageAffectedFixed in
npm elliptic < 6.5.3 6.5.3

Details

As written in the advisory (Markdown source, shown as plain text).

The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

References

External links from the advisory. They lead to third-party sites.