CVE-2020-13822
Signature Malleabillity in elliptic
high entropyCVE-2020-13822GHSA-vh7m-p724-62c2
Entropy / wallet impact
elliptic: The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows.
Description
The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Affected
| Kind | Name | Ecosystem | Versions |
|---|---|---|---|
| package | elliptic | npm | < 6.5.3 |
CWE
Primary sources
- https://github.com/advisories/GHSA-vh7m-p724-62c2 (ghsa)
- https://nvd.nist.gov/vuln/detail/CVE-2020-13822 (ghsa)
- https://github.com/indutny/elliptic/issues/226 (ghsa)
- https://medium.com/@herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4 (ghsa)
- https://www.npmjs.com/package/elliptic (ghsa)
- https://github.com/indutny/elliptic/commit/856fe4d99fe7b6200556e6400b3bf585b1721bec (ghsa)
- https://medium.com/%40herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4 (ghsa)
- https://yondon.blog/2019/01/01/how-not-to-use-ecdsa (ghsa)
- https://github.com/indutny/elliptic (osv)