CVE-2024-42459 Elliptic's EDDSA missing signature length check
Attackers can exploit signature malleability in the Elliptic library by manipulating zero-valued bytes, bypassing signature validation checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42459?
CVE-2024-42459 is a medium-severity vulnerability in n/a, published on 2 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.
Weakness: CWE-347
Which versions are affected by CVE-2024-42459?
2 open source packages ship an affected version, including elliptic. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
elliptic npm | From 4.0.0 | 6.5.7 |
elliptic npm | From 4.0.0 | 6.5.7 |
Products include Indutny Elliptic.
How do I fix CVE-2024-42459?
Upgrade elliptic to 6.5.7 or later.
Is CVE-2024-42459 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-42459 exists.
Other vulnerabilities in n/a
- CVE-2024-48949 Elliptic's verify function omits uniqueness validation
- CVE-2020-13822 Signature Malleabillity in elliptic
- CVE-2020-28498 Cryptographic Issues
- CVE-2024-42460 Elliptic's ECDSA missing check for whether leading bit of r and s is zero
- CVE-2024-48948 Valid ECDSA signatures erroneously rejected in Elliptic
Sources
Also known as AZL-47421, DEBIAN-CVE-2024-42459, GHSA-f7q4-pwc6-w24p, UBUNTU-CVE-2024-42459.