CVE-2024-48948 Valid ECDSA signatures erroneously rejected in Elliptic
Attackers can cause denial of service by triggering signature verification failures in the Elliptic Node.js library due to a truncation anomaly.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-48948?
CVE-2024-48948 is a medium-severity vulnerability in n/a, published on 15 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.
Weakness: CWE-347
Which versions are affected by CVE-2024-48948?
2 open source packages ship an affected version, including elliptic. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
elliptic npm | All versions | 6.6.0 |
elliptic npm | All versions | 6.6.0 |
Linux distribution packages (1)
python-pytest-html openSUSE:Tumbleweed | All versions | 4.1.1-3.1 |
Products include Indutny Elliptic.
How do I fix CVE-2024-48948?
Upgrade elliptic to 6.6.0 or later.
Is CVE-2024-48948 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-48948 exists.
Other vulnerabilities in n/a
- CVE-2024-48949 Elliptic's verify function omits uniqueness validation
- CVE-2020-13822 Signature Malleabillity in elliptic
- CVE-2020-28498 Cryptographic Issues
- CVE-2024-42459 Elliptic's EDDSA missing signature length check
- CVE-2024-42460 Elliptic's ECDSA missing check for whether leading bit of r and s is zero
Sources
Also known as DEBIAN-CVE-2024-48948, GHSA-fc9h-whq2-v747, ROOT-APP-NPM-CVE-2024-48948, UBUNTU-CVE-2024-48948, openSUSE-SU-2024:14433-1.