Information Disclosure

🗓️ 03 Feb 2021 05:06:05Reported by Veracode Vulnerability DatabaseType

Elliptic software vulnerability in `elliptic/ec/key.js` can lead to private key disclosure after ECDH operation

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: Critical Vulnerabilities in libraries used by libraries that IBM Spectrum discover is using (libraries of libraries)	28 Mar 202216:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System	17 Aug 202209:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Machine Learning Accelerator on Cloud Pak for Data is vulnerable to multiple vulnerabilities	12 Dec 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI and/or system health monitoring are now fixed in 5.2.3.7 or higher and 6.0.0.2 or higher	2 Apr 202622:00	–	ibm
IBM Security Bulletins	Security Bulletin: Node.js as used by IBM Security QRadar Analyst Workflow App for IBM QRadar SIEM is vulnerable to multiple vulnerabilities	24 May 202218:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	31 Aug 202310:37	–	ibm
Circl	CVE-2020-28498	2 Feb 202122:39	–	circl
CNNVD	Indutny Elliptic Encryption Problem Vulnerability	2 Feb 202100:00	–	cnnvd
CVE	CVE-2020-28498	2 Feb 202118:50	–	cve
Cvelist	CVE-2020-28498 Cryptographic Issues	2 Feb 202118:50	–	cvelist

Vulners

Node

AND

AND

Source	Link
github	www.github.com/indutny/elliptic/pull/244
github	www.github.com/christianlundkvist/blog/blob/master/2020_05_26_secp256k1_twist_attacks/secp256k1_twist_attacks.md
github	www.github.com/indutny/elliptic/commit/441b7428b0e8f6636c42118ad2aaa186d3c34c3f
npmjs	www.npmjs.com/advisories/1648

09 Mar 2021 03:12Current

1.3Low risk

Vulners AI Score1.3

CVSS 3.16.8

CVSS 24.3

EPSS0.03935