{"id":"CVE-2024-42461","published":"2024-08-02T00:00:00Z","modified":"2025-11-03T22:04:54Z","title":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are…","vendor":null,"product":null,"tier":"tail","description":{"text":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00617,"percentile":0.49517,"provenance":"source"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"references":[{"url":"https://github.com/indutny/elliptic/pull/317","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20241004-0005/","tags":[]}],"priority":{"score":18.6,"factors":[{"name":"EPSS percentile","points":9.9},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.71}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-08-06","earliestUrl":"https://github.com/fevar54/CVE-2024-42461","repos":[{"name":"fevar54/CVE-2024-42461","url":"https://github.com/fevar54/CVE-2024-42461","stars":0,"created":"2024-08-06"}]},"first":{"date":"2024-08-06","source":"PoC-in-GitHub","url":"https://github.com/fevar54/CVE-2024-42461"},"provenance":"source"},"affected":[{"ecosystem":"npm","package":"elliptic","vulnerableRanges":[">=5.2.1, <6.5.7"],"patched":["6.5.7"],"from":["GHSA-49q7-c7j4-3p7m"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2487","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-elliptic-cve-2020-13822","parents":[{"from":"CVE-2020-13822","to":"CVE-2024-42461","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/elliptic/ec/signature.js"],"commits":["https://github.com/indutny/elliptic/commit/856fe4d99fe7b6200556e6400b3bf585b1721bec","https://github.com/indutny/elliptic/commit/accb61e9c1a005e5c8ff96a8b33893100bb42d11"],"basis":"shared function","functions":["_importDER","getLength"]}]}]}}