CVE-2024-48949 (Critical) detected in elliptic-6.5.4.tgz

[mend-for-github-com]

CVE-2024-48949 - Critical Severity Vulnerability

Vulnerable Library - elliptic-6.5.4.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz

Path to dependency file: /node_modules/elliptic/package.json

Path to vulnerable library: /node_modules/elliptic/package.json

Dependency Hierarchy:

• ❌ elliptic-6.5.4.tgz (Vulnerable Library)

Found in HEAD commit: ca255a4489b5c937cfb850ddee46dc5b8c99d85e

Found in base branch: master

Vulnerability Details

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

Publish Date: 2024-10-10

URL: CVE-2024-48949

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-48949

Release Date: 2024-10-10

Fix Resolution: 6.5.6

---

⛑️ Automatic Remediation will be attempted for this issue.