PT-2024-29954

Name of the Vulnerable Software and Affected Versions Elliptic package version 6.5.6 Description The issue concerns EDDSA signature malleability due to a missing signature length check, allowing zero-valued bytes to be removed or appended. This is a cryptographic weakness that can be exploited...

CVE-2024-42460

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero...

CVE-2024-42461

CVE-2024-42461 : In the Node.js Elliptic package v6.5.6, an ECDSA signature malleability vulnerability exists because BER-encoded signatures are allowed. The connected IBM page lists the issue and confirms a CVSS v3.1 base score of 5.3 (confidentiality: Low, integrity: None, availability: None). ...

CVE-2024-42460

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero...

CVE-2024-42459

In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended...

CVE-2024-42459

In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended...

CVE-2024-42460

CVE-2024-42460 : In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability is caused by a missing check for whether the leading bit of r and s is zero. The IBM bulletin aggregates multiple Elliptic-related CVEs and confirms fixes are shipped for IBM Storage Scale products (not detai...

CVE-2024-42459

In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended...

CVE-2024-42461

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed...

CVE-2024-42461

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed...

CVE-2024-42459

CVE-2024-42459 concerns the Elliptic package (Node.js) version 6.5.6. The issue is EDDSA signature malleability caused by a missing signature length check, enabling zero-valued bytes to be removed or appended. The CVE notes a base score of 5.3 (Medium) with network attack vector but no customer-p...

CVE-2024-42461

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed...

PT-2024-29957 · Npm +1 · Elliptic +1

Name of the Vulnerable Software and Affected Versions: Elliptic package version 6.5.6 Description: ECDSA signature malleability occurs in the Elliptic package because BER-encoded signatures are allowed. This issue affects the Elliptic package for Node.js. Recommendations: For Elliptic package...

PT-2024-33290

Name of the Vulnerable Software and Affected Versions Elliptic package versions prior to 6.5.6 Description The issue concerns the Elliptic package for Node.js, specifically the EDDSA implementation. It does not perform the required check if the signature proofs is within the bounds of the order n...

Medium: golang

Issue Overview: Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. CVE-2022-23772 cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This...

golang: crypto/elliptic: IsOnCurve returns true for invalid field elements

A flaw was found in the elliptic package of the crypto library in golang when the IsOnCurve function could return true for invalid field elements. This flaw allows an attacker to take advantage of this undefined behavior, affecting the availability and integrity of the resource...

Struts: Validator Without Form Field

Overview std/crypto/elliptic is a Go standard library package std/crypto/elliptic Affected versions of this package are vulnerable to Struts: Validator Without Form Field. Go Vulnerability Report: via the IsOnCurve function. An attacker can trigger a panic or cause invalid cryptographic operation...

CVE-2022-23806

A flaw was found in the elliptic package of the crypto library in golang when the IsOnCurve function could return true for invalid field elements. This flaw allows an attacker to take advantage of this undefined behavior, affecting the availability and integrity of the resource...

Elliptic package 安全漏洞

Elliptic package is a JavaScript-based elliptic curve cryptographic library. A security vulnerability exists in crypto/elliptic that stems from IsOnCurve in crypto elliptic before Go 1.16.14 and 1.17. X before 1.17.7 may incorrectly return true in the case of X with a large value. integer values...

GHSA-R9P9-MRJM-926W Elliptic Uses a Broken or Risky Cryptographic Algorithm

The npm package elliptic before version 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential...