high7.7
CVE-2020-13822
Signature Malleabillity in elliptic
Impact
The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | elliptic | < 6.5.3 | 6.5.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Indutny | Elliptic | Version 6.5.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/indutny/elliptic/issues/226
- https://medium.com/%40herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4
- https://www.npmjs.com/package/elliptic
- https://yondon.blog/2019/01/01/how-not-to-use-ecdsa/
- https://github.com/advisories/GHSA-vh7m-p724-62c2
- https://nvd.nist.gov/vuln/detail/CVE-2020-13822
- https://medium.com/@herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4
- https://github.com/indutny/elliptic/commit/856fe4d99fe7b6200556e6400b3bf585b1721bec
- https://yondon.blog/2019/01/01/how-not-to-use-ecdsa