CVE-2020-13822 Signature Malleabillity in elliptic
The Elliptic library allows ECDSA signature malleability via encoding variations or integer overflows, impacting applications relying on canonical signatures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13822?
CVE-2020-13822 is a high-severity vulnerability in n/a, published on 4 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Weakness: CWE-190
Which versions are affected by CVE-2020-13822?
2 open source packages ship an affected version, including elliptic. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
elliptic npm | All versions | 6.5.3 |
elliptic npm | All versions | 6.5.3 |
Products include Indutny Elliptic.
How do I fix CVE-2020-13822?
Upgrade elliptic to 6.5.3 or later.
Is CVE-2020-13822 being exploited?
There is no known exploitation of CVE-2020-13822 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-48949 Elliptic's verify function omits uniqueness validation
- CVE-2020-28498 Cryptographic Issues
- CVE-2024-42459 Elliptic's EDDSA missing signature length check
- CVE-2024-42460 Elliptic's ECDSA missing check for whether leading bit of r and s is zero
- CVE-2024-48948 Valid ECDSA signatures erroneously rejected in Elliptic
Sources
Also known as CLSA-2026-1792163848, DEBIAN-CVE-2020-13822, GHSA-vh7m-p724-62c2, ROOT-APP-NPM-CVE-2020-13822, UBUNTU-CVE-2020-13822.