The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

🗓️ 16 Oct 2024 07:00:00Reported by MicrosoftType

The verify function in elliptic eddsa index.js before 6.5.6 omits S validation against the curve order and negativity.

Reporter	Title	Published	Views	Family All 113
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to improper verification of cryptographic signature due to elliptic ( CVE-2024-48949 )	16 Jun 202509:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: User Entity Behavior Analytics app for IBM QRadar SIEM includes components with known vulnerabilities	29 Aug 202517:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Elliptic	26 Feb 202518:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Dashboards that use COS S3 storage are vulnerable to denial of service and security restrictions bypass [CVE-2024-48948] [CVE-2024-48949]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	9 Dec 202409:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Manage Component uses elliptic-6.5.4.tgz (Publicly disclosed vulnerability found by Mend)	3 Jun 202510:33	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI and/or system health monitoring are now fixed in 5.2.3.7 or higher and 6.0.0.2 or higher	2 Apr 202622:00	–	ibm
AstraLinux	Astra Linux - уязвимость в node-elliptic	3 May 202623:59	–	astralinux
CBLMariner	CVE-2024-48949 affecting package reaper for versions less than 3.1.1-13	15 Oct 202423:32	–	cbl_mariner