CVE-2024-48948
Oct. 16, 2024, 4:38 p.m.
Tags
Product(s) Impacted
Node.js
- 6.5.7
Description
The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.
Weaknesses
Date
Published: Oct. 15, 2024, 2:15 p.m.
Last Modified: Oct. 16, 2024, 4:38 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
cve@mitre.org
References
cve@mitre.org
cve@mitre.org