CVE-2020-13822

Signature Malleabillity in elliptic

Description

The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading

Vulnerability Details

Score

7.7

Score Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected Versions

elliptic < 6.5.3

Severity

High

Ecosystem

JavaScript

Publish Date

July 29, 2020

Modified Date

October 16, 2024