{"id":"CVE-2024-48948","published":"2024-10-15T00:00:00Z","modified":"2025-11-25T15:41:32Z","title":"The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if…","vendor":null,"product":null,"tier":"tail","description":{"text":"The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00553,"percentile":0.46162,"provenance":"source"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"references":[{"url":"https://github.com/indutny/elliptic/pull/322","tags":[]},{"url":"https://github.com/indutny/elliptic/issues/321","tags":[]},{"url":"https://blog.trailofbits.com/2025/11/18/we-found-cryptography-bugs-in-the-elliptic-library-using-wycheproof/","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20241220-0004/","tags":[]}],"priority":{"score":12.6,"factors":[{"name":"EPSS percentile","points":9.23},{"name":"CVSS severity","points":3.36}]},"affected":[{"ecosystem":"npm","package":"elliptic","vulnerableRanges":["<6.6.0"],"patched":["6.6.0"],"from":["GHSA-fc9h-whq2-v747"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3034","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-elliptic-cve-2020-13822","parents":[{"from":"CVE-2024-42459","to":"CVE-2024-48948","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:elliptic","fromFixed":"6.5.7","toFixed":"6.6.0","daysApart":74},{"kind":"same-code","provenance":"machine","files":["lib/elliptic/ec/index.js","lib/elliptic/ec/key.js"],"commits":["https://github.com/indutny/elliptic/commit/accb61e9c1a005e5c8ff96a8b33893100bb42d11","https://github.com/indutny/elliptic/commit/c0690b36be043ee73c1780ae4b7df48632b11cf9","https://github.com/indutny/elliptic/commit/34c853478cec1be4e37260ed2cb12cdbdc6402cf"],"basis":"rarely changed file"}]},{"from":"CVE-2020-28498","to":"CVE-2024-48948","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/elliptic/ec/key.js"],"commits":["https://github.com/indutny/elliptic/commit/441b7428b0e8f6636c42118ad2aaa186d3c34c3f","https://github.com/indutny/elliptic/commit/34c853478cec1be4e37260ed2cb12cdbdc6402cf"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2024-42459","published":"2024-08-02","fixed":"6.5.7","kev":false},{"cve":"CVE-2024-42460","published":"2024-08-02","fixed":"6.5.7","kev":false},{"cve":"CVE-2024-42461","published":"2024-08-02","fixed":"6.5.7","kev":false},{"cve":"CVE-2024-48948","published":"2024-10-15","fixed":"6.6.0","kev":false}],"package":"npm:elliptic"}}