Elliptic package input validation error vulnerability

Elliptic package is a JavaScript-based elliptic curve cryptographic library. A security vulnerability exists in Elliptic package version 6.5.2 Node.js. An attacker can exploit the vulnerability to elevate privileges...

CVE-2020-13822

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature...

CVE-2020-13822

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature...

DEBIAN-CVE-2020-13822

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature...

Integer overflow

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature...

CVE-2020-13822

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature...

UBUNTU-CVE-2020-13822

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature...

CVE-2020-13822

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature...

CVE-2020-13822

CVE-2020-13822 concerns the Elliptic package for Node.js (notably versions around 6.5.2) and describes ECDSA signature malleability caused by variations in encoding, leading to spurious or non-canonical signatures (e.g., leading '\0' bytes) and potential security impact if a single canonical sign...

CVE-2020-13822

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature...

PT-2020-13705 · Elliptic · Elliptic

Name of the Vulnerable Software and Affected Versions: Elliptic package versions prior to 6.5.3 Description: The issue allows ECDSA signature malleability via variations in encoding, leading '0' bytes, or integer overflows. This could have a security-relevant impact if an application relied on a...

fastecdsa data forgery issue vulnerability

fastecdsa is a Python library for fast elliptic curve encryption by AntonKueltz Software Developers. A security vulnerability exists in fastecdsa versions prior to 2.1.2. An attacker can exploit the vulnerability to benefit by successfully guessing the user whose signature verification will fail...

USN-4376-1 openssl vulnerabilities

Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya, and Billy Brumley discovered that OpenSSL incorrectly handled ECDSA signatures. An attacker could possibly use this issue to perform a timing side-channel attack and recover private ECDSA keys...

The vulnerability of the implementation of the elliptic curve-based cryptography method in the Microsoft Research JavaScript Cryptography Library allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the implementation of the elliptic curve-based cryptography method in Microsoft Research’s JavaScript Cryptography Library is related to incorrect calculations. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

CVE-2019-9498

A flaw was found in wpasupplicant. An attack using invalid scalar/element values is possible against the EAP-pwd server since hostapd and wpasupplicant did not validate these values in the received EAP-pwd-Commit messages. When processing an EAP-pwd Commit frame, the peer's scalar and element...

openssl: side-channel weak encryption vulnerability

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters instead of using a named curve. In those cases it is possible that such a group does not have...

openSUSE Security Update : freeradius-server (openSUSE-2020-542)

This update for freeradius-server fixes the following issues : Security issues fixed : - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. - CVE-2019-11234: Fixed an authentication bypass caused by...

openSUSE: Security Advisory for freeradius-server (openSUSE-SU-2020:0542-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0542-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. - CVE-2019-11234: Fixed an authentication bypass caused by...

Security update for freeradius-server (important)

openSUSE Security Update: Security update for freeradius-server Announcement ID: openSUSE-SU-2020:0542-1 Rating: important References: 1132549 1132664 Cross-References: CVE-2019-11234 CVE-2019-11235 Affected Products: openSUSE Leap 15.1 An update that fixes two vulnerabilities is now available...