CVE-2024-48948

MEDIUM

elliptic < 6.6.0 - Improper Verification of Cryptographic Signature via ECDSA Hash Truncation

Title source: llm
STIX 2.1

Description

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.

References (4)

Core 4

Scores

CVSS v3 4.8
EPSS 0.0056
EPSS Percentile 41.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-347
Status published
Products (2)
indutny/elliptic 6.5.7
npm/elliptic 0 - 6.6.0npm
Published Oct 15, 2024
Tracked Since Feb 18, 2026