CVE-2024-48948: Vulnerability in Elliptic Package Leading to Invalid ECDSA Signature Rejections
Summary
CVE-2024-48948: Valid ECDSA signatures erroneously rejected in Elliptic. Affects elliptic versions < 6.5.7. No fix is published. How to fix ↓
Also tracked for
- node-elliptic · Debian:11
The same CVE-2024-48948 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Elliptic package is a widely used cryptographic library for Node.js that implements elliptic curve cryptography (ECC). It provides functionalities for digital signatures, key generation, and encryption. The package is essential for secure communications and transactions in various applications. However, a vulnerability in version 6.5.7 has been identified, which affects the verification of ECDSA signatures, potentially compromising the integrity of cryptographic operations.
Vulnerability Detail
The vulnerability arises from an issue in the ECDSA implementation of the Elliptic package version 6.5.7. It fails to correctly verify valid signatures when the hash contains at least four leading zero bytes, particularly if the order of the elliptic curve's base point is smaller than the hash. This anomaly, referred to as _truncateToN, results in legitimate signatures being erroneously rejected. Consequently, valid transactions or communications may be flagged as invalid, leading to potential disruptions in services relying on this package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as it is feasible.
Conclusion
The vulnerability identified as CVE-2024-48948 in the Elliptic package poses a significant risk by incorrectly rejecting valid ECDSA signatures. It is crucial for developers using this package to update to the patched version to mitigate potential disruptions in their applications. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for elliptic →
FAQ
The impact includes the rejection of valid ECDSA signatures, which can lead to legitimate transactions being flagged as invalid, potentially disrupting services.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. By utilizing the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
The affected version is 6.5.7. Versions prior to this may not be impacted, but it is recommended to use the latest version for security.
While there is no direct risk of data loss, the rejection of valid signatures can lead to failed transactions, which may affect data integrity in applications relying on these signatures.
If immediate updates are not possible, monitor your application closely for any issues related to signature verification and consider implementing additional logging to capture any rejected signatures.
References
Related vulnerabilities
Recent vulnerabilities recorded for elliptic.
