Cryptographic issues in elliptic - CVE-2020-13822

Vulnerability details

The vulnerability allows a remote attacker to comrpomise the target system.

The vulnerability exists due to the affected software allows ECDSA signature malleability via variations in encoding, leading "\0" bytes, or integer overflows. A remote attacker can cause a security-relevant impact if an application relied on a single canonical signature.

Affected software

How to mitigate CVE-2020-13822

External References

• https://github.com/indutny/elliptic/issues/226
• https://medium.com/@herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4
• https://www.npmjs.com/package/elliptic
• https://yondon.blog/2019/01/01/how-not-to-use-ecdsa/
• https://www.npmjs.com/advisories/1547

Related Security Bulletins

• Cryptographic issues in elliptic package for npm
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data