GHSA-r9p9-mrjm-926w

    Dashboard / Vulnerabilities / GHSA-r9p9-mrjm-926w

    GHSA-r9p9-mrjm-926w

    Published: 8 Mar 2021Last Modified: 14 Jan 2025

    Summary: Elliptic Uses a Broken or Risky Cryptographic Algorithm

    Details: The npm package `elliptic` before version 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.

    References: https://nvd.nist.gov/vuln/detail/CVE-2020-28498, https://github.com/indutny/elliptic/pull/244/commits, https://github.com/indutny/elliptic/commit/441b7428b0e8f6636c42118ad2aaa186d3c34c3f, https://github.com/christianlundkvist/blog/blob/master/2020_05_26_secp256k1_twist_attacks/secp256k1_twist_attacks.md, https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1069836, https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899, https://www.npmjs.com/package/elliptic

    Affected packages

    Package

    Name: elliptic

    Purl: pkg:npm/elliptic

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -6.5.4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-r9p9-mrjm-926w | CVE-DB