Open mend-bolt-for-github[bot] opened 2 years ago
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
CVE-2020-13822 - High Severity Vulnerability
Vulnerable Libraries - elliptic-6.4.0.tgz, elliptic-6.4.1.tgz, elliptic-6.5.1.tgz
elliptic-6.4.0.tgz
EC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.4.0.tgz
Path to dependency file: /aws-node-oauth-dropbox-api/package.json
Path to vulnerable library: /aws-node-oauth-dropbox-api/node_modules/elliptic/package.json
Dependency Hierarchy: - serverless-plugin-optimize-3.0.3-rc.1.tgz (Root Library) - browserify-14.5.0.tgz - crypto-browserify-3.12.0.tgz - create-ecdh-4.0.3.tgz - :x: **elliptic-6.4.0.tgz** (Vulnerable Library)
elliptic-6.4.1.tgz
EC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.4.1.tgz
Path to dependency file: /aws-node-typescript-nest/package.json
Path to vulnerable library: /aws-node-typescript-nest/node_modules/elliptic/package.json,/aws-node-github-check/node_modules/elliptic/package.json,/aws-node-fullstack/frontend/node_modules/elliptic/package.json
Dependency Hierarchy: - react-scripts-2.1.8.tgz (Root Library) - webpack-4.28.3.tgz - node-libs-browser-2.2.0.tgz - crypto-browserify-3.12.0.tgz - create-ecdh-4.0.3.tgz - :x: **elliptic-6.4.1.tgz** (Vulnerable Library)
elliptic-6.5.1.tgz
EC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.1.tgz
Path to dependency file: /aws-node-typescript-sqs-standard/package.json
Path to vulnerable library: /aws-node-typescript-sqs-standard/node_modules/elliptic/package.json,/aws-node-typescript-kinesis/node_modules/elliptic/package.json
Dependency Hierarchy: - webpack-4.41.2.tgz (Root Library) - node-libs-browser-2.2.1.tgz - crypto-browserify-3.12.0.tgz - create-ecdh-4.0.3.tgz - :x: **elliptic-6.5.1.tgz** (Vulnerable Library)
Found in HEAD commit: dcbe4aefe4b3685f4b15493a01db0f19b118a0c4
Found in base branch: master
Vulnerability Details
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Publish Date: 2020-06-04
URL: CVE-2020-13822
CVSS 3 Score Details (7.7)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2020-06-04
Fix Resolution (elliptic): 6.5.3
Direct dependency fix Resolution (react-scripts): 3.0.0
Fix Resolution (elliptic): 6.5.3
Direct dependency fix Resolution (webpack): 4.41.3
Step up your Open Source Security Game with Mend here