The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.
References
| Link | Resource |
|---|---|
| https://github.com/indutny/elliptic/issues/321 | Exploit Issue Tracking |
| https://github.com/indutny/elliptic/pull/322 | Exploit Issue Tracking |
| https://security.netapp.com/advisory/ntap-20241220-0004/ | Third Party Advisory |
Configurations
History
20 Jun 2025, 16:18
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:indutny:elliptic:6.5.7:*:*:*:*:node.js:*:* | |
| First Time |
Indutny elliptic
Indutny |
|
| References | () https://github.com/indutny/elliptic/issues/321 - Exploit, Issue Tracking | |
| References | () https://github.com/indutny/elliptic/pull/322 - Exploit, Issue Tracking | |
| References | () https://security.netapp.com/advisory/ntap-20241220-0004/ - Third Party Advisory |
20 Dec 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2024-10-15 14:15
Updated : 2025-06-20 16:18
NVD link : CVE-2024-48948
Mitre link : CVE-2024-48948
CVE.ORG link : CVE-2024-48948
JSON object : View
Products Affected
indutny
- elliptic
CWE
CWE-347
Improper Verification of Cryptographic Signature