Sensitive information sent insecurely In node-jose
Description
Invalid Curve Attack in node-jose
Affected versions of node-jose are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.
Recommendation
Update to version 0.9.3 or later.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | 0.9.3 |
Aliases
1. 2. 3. 4.
References
1. 2. 3. 4. 5.