Valid ECDSA signatures erroneously rejected in Elliptic

🗓️ 15 Oct 2024 15:30:56Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 38 Views

Valid ECDSA signatures rejected in Elliptic package 6.5.7 for Node.js due to hash anomal

Reporter	Title	Published	Views	Family All 77
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to a remote attacker (CVE-2024-48948)	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Product Hub is affected by several vulnerabilities	11 Dec 202422:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	27 Feb 202513:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Elliptic package 6.5.7 for Node.js affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	21 May 202514:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to a remote attacker (CVE-2024-48948)	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics Mobile (iOS) is affected by multiple vulnerabilities	2 Mar 202501:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Dashboards that use COS S3 storage are vulnerable to denial of service and security restrictions bypass [CVE-2024-48948] [CVE-2024-48949]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Manage Component uses elliptic-6.5.4.tgz (Publicly disclosed vulnerability found by Mend)	3 Jun 202510:33	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI and/or system health monitoring are now fixed in 5.2.3.7 or higher and 6.0.0.2 or higher	2 Apr 202622:00	–	ibm

Vulners

Node

elliptic_project ellipticRange<6.6.0npm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-48948
github	www.github.com/indutny/elliptic/issues/321
github	www.github.com/indutny/elliptic/pull/322
github	www.github.com/indutny/elliptic/commit/34c853478cec1be4e37260ed2cb12cdbdc6402cf
security	www.security.netapp.com/advisory/ntap-20241220-0004
blog	www.blog.trailofbits.com/2025/11/18/we-found-cryptography-bugs-in-the-elliptic-library-using-wycheproof
github	www.github.com/advisories/GHSA-fc9h-whq2-v747

27 Nov 2025 08:43Current

9.2High risk

Vulners AI Score9.2

CVSS 3.14.8

EPSS0.00162

SSVC

ecdsa elliptic package node.js valid signatures hash anomaly