CVE-2024-48930 secp256k1-node vulnerable to private key extraction over ECDH

secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1. In elliptic-based version, loadUncompressedPublicKey has a check that the public key is on the curve. Prior to versions 5.0.1, 4.0.4, and 3.8.1, however, loadCompressedPublicKey is missing that...

CVE-2024-48930

CVE-2024-48930 affects secp256k1-node (elliptic-based build) where loadCompressedPublicKey fails to validate public keys on the curve, enabling an attacker to derive a private key after as few as 11 ECDH sessions. Reports note that publicKeyVerify() can misreport invalid keys as valid, and public...

CVE-2024-48930 secp256k1-node vulnerable to private key extraction over ECDH

secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1. In elliptic-based version, loadUncompressedPublicKey has a check that the public key is on the curve. Prior to versions 5.0.1, 4.0.4, and 3.8.1, however, loadCompressedPublicKey is missing that...