CVE-2020-13822

Katalog CVE

CVSS 7.7 · High EPSS 2,6%

Kerentanan Integer Overflow or Wraparound pada indutny elliptic. Skor CVSS 3.1 7.7 (High) menurut NVD.

Deskripsi (NVD)

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Rincian

Terbit di NVD

4 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

2,6% peluang dieksploitasi; lebih tinggi dari 85,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/indutny/elliptic/issues/226 exploit · advisory pihak ketiga
• https://www.npmjs.com/package/elliptic advisory pihak ketiga
• https://yondon.blog/2019/01/01/how-not-to-use-ecdsa/ advisory pihak ketiga
• https://medium.com/%40herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4