CVE-2025-14505 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

org.webjars.npm:bitcore-lib (=0.15.0), org.webjars.npm:bitcore-mnemonic (=1.5.0) +6 more potentially affected by CVE-2025-14505 via org.webjars.npm:elliptic (>=6.4.0 <=6.6.1)

org.webjars.npm:elliptic MAVEN version =6.4.0, =4.0.0, =3.2.0, =4.0.2 Source cves: CVE-2025-14505 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-14908845...

CVE-2025-14505 Elliptic Cryptanalysis vulnerability when `k` has leading zeros

The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...