Fluid Attacks Database

Description

Elliptic allows BER-encoded signatures In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	node-elliptic	>=0 <6.5.7+dfsg-1	6.5.7+dfsg-1
debian 12	node-elliptic	=6.5.4~dfsg-2 \|\| =6.5.7+dfsg-1 \|\| =6.6.1+dfsg+~6.4.18-1 \|\| =6.6.1+dfsg+~6.4.18-2 \|\| =6.6.1+dfsg-1	-
debian 13	node-elliptic	>=0 <6.5.7+dfsg-1	6.5.7+dfsg-1
npm	elliptic	>=5.2.1 <6.5.7	6.5.7
rpm rhel6	thunderbird	-	-
rpm rhel6	firefox	-	-
rpm rhel9	bootc-image-builder	-	-
rpm rhel8	grafana	-	-
rpm rhel7	thunderbird	-	-

Aliases

1. CVE-2024-424612. NVD-2024-424613. OSV-DEBIAN-2024-424614. OSV-2024-424615. GCVE-2024-424616. SECURITY-TRACKER-CVE-2024-42461

References

1. https://github.com/fevar54/CVE-2024-424612. https://github.com/indutny/elliptic/pull/3173. https://github.com/indutny/elliptic/commit/accb61e9c1a005e5c8ff96a8b33893100bb42d114. https://security.netapp.com/advisory/ntap-20241004-0005

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.