{"id":"CVE-2024-42460","published":"2024-08-02T00:00:00Z","modified":"2025-11-03T22:04:53Z","title":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for…","vendor":null,"product":null,"tier":"tail","description":{"text":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00459,"percentile":0.39783,"provenance":"source"},"cwes":[{"id":"CWE-130","name":"Improper Handling of Length Parameter Inconsistency"}],"references":[{"url":"https://github.com/indutny/elliptic/pull/317","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20241004-0005/","tags":[]}],"priority":{"score":11.7,"factors":[{"name":"EPSS percentile","points":7.96},{"name":"CVSS severity","points":3.71}]},"affected":[{"ecosystem":"npm","package":"elliptic","vulnerableRanges":[">=2.0.0, <6.5.7"],"patched":["6.5.7"],"from":["GHSA-977x-g7h5-7qgw"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2543","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-elliptic-cve-2020-13822","parents":[{"from":"CVE-2020-13822","to":"CVE-2024-42460","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/elliptic/ec/signature.js"],"commits":["https://github.com/indutny/elliptic/commit/856fe4d99fe7b6200556e6400b3bf585b1721bec","https://github.com/indutny/elliptic/commit/accb61e9c1a005e5c8ff96a8b33893100bb42d11"],"basis":"shared function","functions":["_importDER","getLength"]}]}]}}