Critical Vulnerability in Node-Elliptic Package: Potential Exposure of Private Keys
Summary
UBUNTU-CVE-2020-28498: The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. Affects node-elliptic versions 6.4.0+dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-Elliptic is a widely used cryptographic library in Node.js that implements elliptic curve cryptography. It provides functionalities for secure key generation, signing, and verification. However, certain versions of this package are vulnerable to a cryptographic issue that can lead to the exposure of private keys, particularly when using the secp256k1 curve.
Vulnerability Detail
The vulnerability arises from a flaw in the secp256k1 implementation within the elliptic/ec/key.js file. Specifically, there is no validation to ensure that the public key point passed into the derive function exists on the secp256k1 curve. This oversight can lead to scenarios where the private key used in ECDH operations may be revealed after multiple operations, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the affected versions of the node-elliptic package until an update can be applied. Consider using alternative libraries for elliptic curve cryptography that do not have this vulnerability.
Conclusion
The node-elliptic package has a critical vulnerability that can expose private keys due to insufficient validation in its implementation. It is crucial to update to a patched version to ensure the security of cryptographic operations. Utilize tools like Vulert to monitor for vulnerabilities in your software.
See every vulnerability recorded for node-elliptic →
FAQ
The CVSS score of this vulnerability is 6.8, indicating a medium severity level.
Versions of node-elliptic prior to 6.5.4 are vulnerable to this issue.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability could lead to the exposure of private keys, compromising the security of cryptographic operations and potentially allowing unauthorized access to sensitive data.
While the best solution is to update to a patched version, you can temporarily avoid using the affected versions of the node-elliptic package and consider alternative libraries.
Related vulnerabilities
Recent vulnerabilities recorded for node-elliptic.
