Skip to main content

Improper Verification of Cryptographic Signature in elliptic

CVE-2024-48948

  • elliptic
  • org.webjars.npm:elliptic
Low
2.3/10

Summary

The Elliptic package versions through 6.5.7 for Node.js, in their ECDSA implementation, do not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash because of an "_truncateToN" anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.

  • HIGH
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-347 - Improper Verification of Cryptographic Signature

A cryptographic protocol is meant to ensure that services are provided in a secure manner. An application with absent or improper verification of cryptographic signatures allows malicious users to feed false messages to valid users or to disclose sensitive data, subverting the goals of the protocol. This can lead to security failures such as false authentication, account hijacking, and privilege escalation.

References

Advisory Timeline

  • Published