Published: 04/06/2020 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.7 | Impact Score: 5.5 | Exploitability Score: 2.2

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Vulnerable Product	Search on Vulmon	Subscribe to Product
elliptic project elliptic 6.5.2

Debian Bug report logs - #963149 node-elliptic: CVE-2020-13822 Package: src:node-elliptic; Maintainer for src:node-elliptic is Debian Javascript Maintainers <pkg-javascript-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 19 Jun 2020 17:15:02 UTC Severity: important Tag ...

Synopsis Important: Red Hat Single Sign-On 744 security update Type/Severity Security Advisory: Important Topic A security update is now available for Red Hat Single Sign-On 74 from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...

Synopsis Moderate: OpenShift Container Platform 461 image security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat OpenShift Container Platform 46Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability S ...

CWE-190 https://yondon.blog/2019/01/01/how-not-to-use-ecdsa/https://www.npmjs.com/package/elliptic https://github.com/indutny/elliptic/issues/226 https://medium.com/%40herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=963149 https://nvd.nist.gov

CVE-2020-13822

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect