Security Bulletin: Vulnerability in Elliptic affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Elliptic has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

CVE-2025-14505 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

org.webjars.npm:bitcore-lib (0.15.0), org.webjars.npm:bitcore-mnemonic (1.5.0) +6 more potentially affected by CVE-2025-14505 via org.webjars.npm:elliptic (>=6.4.0, <=6.6.1)

org.webjars.npm:elliptic MAVEN version =6.4.0, =4.0.0, =3.2.0, =4.0.2 Source cves: CVE-2025-14505 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-14908845...

CVE-2025-14505 Elliptic Cryptanalysis vulnerability when `k` has leading zeros

The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...