The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
CVE-2020-13822 - Medium Severity Vulnerability
EC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz
Path to dependency file: /tmp/ws-scm/apexo/package.json
Path to vulnerable library: /tmp/ws-scm/apexo/node_modules/elliptic/package.json
Dependency Hierarchy: - crypto-pouch-3.1.3.tgz (Root Library) - native-crypto-1.8.1.tgz - :x: **elliptic-6.5.2.tgz** (Vulnerable Library)
Found in HEAD commit: 211bb1c7c57b2af02723dcca4843a04cc0621ac4
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Publish Date: 2020-06-04
URL: CVE-2020-13822
Base Score Metrics: - Exploitability Metrics: - Attack Vector: N/A - Attack Complexity: N/A - Privileges Required: N/A - User Interaction: N/A - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS3 Scores, click here.Step up your Open Source Security Game with WhiteSource here