CVE-2020-28498 Cryptographic Issues
Attackers can potentially reveal private keys due to missing curve validation in the elliptic library's ECDH implementation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-28498?
CVE-2020-28498 is a medium-severity vulnerability in elliptic, published on 2 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.
Weakness: CWE-327
Which versions are affected by CVE-2020-28498?
2 open source packages ship an affected version, including elliptic. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
elliptic npm | All versions | 6.5.4 |
elliptic npm | All versions | 6.5.4 |
Products include Indutny Elliptic.
How do I fix CVE-2020-28498?
Upgrade elliptic to 6.5.4 or later.
Is CVE-2020-28498 being exploited?
There is no known exploitation of CVE-2020-28498 in the wild and no public exploit code.
Other vulnerabilities in elliptic
- CVE-2024-48949 Elliptic's verify function omits uniqueness validation
- CVE-2020-13822 Signature Malleabillity in elliptic
- CVE-2024-42459 Elliptic's EDDSA missing signature length check
- CVE-2024-42460 Elliptic's ECDSA missing check for whether leading bit of r and s is zero
- CVE-2024-48948 Valid ECDSA signatures erroneously rejected in Elliptic
Sources
Also known as CLSA-2026-1792163746, DEBIAN-CVE-2020-28498, GHSA-r9p9-mrjm-926w, ROOT-APP-NPM-CVE-2020-28498, UBUNTU-CVE-2020-28498.