Lucene search
GoogleOSV:CVE-2022-41340HistorySep 24, 2022 - 7:15 p.m.
CVE-2022-41340
2022-09-2419:15:08
Google
osv.dev
3
node.js
ecdsa signature forgery
secp256k1-js package
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
0.001
Percentile
38.5%
The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.
Related
osv
osv
nvd
nvd
CVE-2022-41340
2022-09-24 19:15:08
prion
prion
Design/Logic Flaw
2022-09-24 19:15:00
github
github
cve
cve
CVE-2022-41340
2022-09-24 19:15:08
cvelist
cvelist
CVE-2022-41340
2022-09-24 18:22:27
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
0.001
Percentile
38.5%
Related for OSV:CVE-2022-41340