Use of a broken or risky cryptographic algorithm in elliptic - CVE-2020-28498

Vulnerability identifier: #VU63701

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28498

CWE-ID: CWE-327

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to cryptographic issues in the secp256k1 implementation in elliptic/ec/key.js. A remote attacker can pass specially crafted public key point to the application and gain access to sensitive information.

elliptic
IBM Watson Machine Learning Accelerator
Storage Scale
IBM Security QRadar Analyst Workflow
QRadar User Behavior Analytics

Install updates from vendor's website.

elliptic - update to 6.5.4
Storage Scale - addressed in versions 5.2.3.7, 6.0.0.2
IBM Security QRadar Analyst Workflow - update to 2.15.1
QRadar User Behavior Analytics - update to 4.1.13

• https://github.com/christianlundkvist/blog/blob/master/2020_05_26_secp256k1_twist_attacks/secp256k1_twist_attacks.md
• https://github.com/indutny/elliptic/commit/441b7428b0e8f6636c42118ad2aaa186d3c34c3f
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1069836
• https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899

• Use of a broken or risky cryptographic algorithm in indutny elliptic
• Multiple vulnerabilities in IBM Security QRadar Analyst Workflow
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Storage Scale