{"id":"CVE-2020-13822","published":"2020-06-04T14:01:53Z","modified":"2024-08-04T12:25:16Z","title":"The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\\0'…","vendor":null,"product":null,"tier":"tail","description":{"text":"The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02705,"percentile":0.8594,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.npmjs.com/package/elliptic","tags":["x_refsource_MISC"]},{"url":"https://github.com/indutny/elliptic/issues/226","tags":["x_refsource_MISC"]},{"url":"https://yondon.blog/2019/01/01/how-not-to-use-ecdsa/","tags":["x_refsource_MISC"]},{"url":"https://medium.com/%40herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4","tags":["x_refsource_MISC"]}],"priority":{"score":17.2,"factors":[{"name":"EPSS percentile","points":17.19}]},"affected":[{"ecosystem":"npm","package":"elliptic","vulnerableRanges":["<6.5.3"],"patched":["6.5.3"],"from":["GHSA-vh7m-p724-62c2"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0571","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-elliptic-cve-2020-13822","children":[{"from":"CVE-2020-13822","to":"CVE-2024-42459","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/elliptic/ec/signature.js"],"commits":["https://github.com/indutny/elliptic/commit/856fe4d99fe7b6200556e6400b3bf585b1721bec","https://github.com/indutny/elliptic/commit/accb61e9c1a005e5c8ff96a8b33893100bb42d11","https://github.com/indutny/elliptic/commit/c0690b36be043ee73c1780ae4b7df48632b11cf9"],"basis":"shared function","functions":["_importDER","getLength"]}]},{"from":"CVE-2020-13822","to":"CVE-2024-42460","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/elliptic/ec/signature.js"],"commits":["https://github.com/indutny/elliptic/commit/856fe4d99fe7b6200556e6400b3bf585b1721bec","https://github.com/indutny/elliptic/commit/accb61e9c1a005e5c8ff96a8b33893100bb42d11"],"basis":"shared function","functions":["_importDER","getLength"]}]},{"from":"CVE-2020-13822","to":"CVE-2024-42461","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/elliptic/ec/signature.js"],"commits":["https://github.com/indutny/elliptic/commit/856fe4d99fe7b6200556e6400b3bf585b1721bec","https://github.com/indutny/elliptic/commit/accb61e9c1a005e5c8ff96a8b33893100bb42d11"],"basis":"shared function","functions":["_importDER","getLength"]}]}],"packageHistory":[{"cve":"CVE-2020-13822","published":"2020-06-04","fixed":"6.5.3","kev":false},{"cve":"CVE-2020-28498","published":"2021-02-02","fixed":"6.5.4","kev":false,"link":{"from":"CVE-2020-13822","to":"CVE-2020-28498","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:elliptic","fromFixed":"6.5.3","toFixed":"6.5.4","daysApart":243}]}},{"cve":"CVE-2024-48949","published":"2024-10-10","fixed":"6.5.6","kev":false},{"cve":"CVE-2024-42459","published":"2024-08-02","fixed":"6.5.7","kev":false}],"package":"npm:elliptic"}}