CVE-2020-13822

EUVD-2020-0571
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
Affected Products (NVD)
VendorProductVersion
indutnyelliptic
6.5.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
node-elliptic
bookworm
6.5.4~dfsg-2
fixed
bullseye
6.5.4~dfsg-1
fixed
sid
6.5.7+dfsg-1
fixed
trixie
6.5.7+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-elliptic
bionic
needs-triage
eoan
ignored
focal
needs-triage
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
dne
xenial
dne
Common Weakness Enumeration
References
https://github.com/indutny/elliptic/issues/226
https://medium.com/%40herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4
https://www.npmjs.com/package/elliptic
https://yondon.blog/2019/01/01/how-not-to-use-ecdsa/
https://github.com/indutny/elliptic/issues/226
https://medium.com/%40herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4
https://www.npmjs.com/package/elliptic
https://yondon.blog/2019/01/01/how-not-to-use-ecdsa/