CVE-2020-13822: Integer Overflow
The Elliptic for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Other sources
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ellipticto a version that resolves this vulnerability.Fixed in 6.5.3 - Upgrade
Upgrade
redhat/nodejs-ellipticto a version that resolves this vulnerability.Fixed in 6.5.3 - Upgrade
Upgrade
elliptic (Node.js)to a version that resolves this vulnerability.Fixed in 6.5.3 - Operational
Ensure any applications that relied on a single canonical ECDSA signature treat signatures as potentially non-canonical (e.g., do canonicalization/verification as appropriate) after upgrading elliptic to prevent signature malleability issues.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-13822?
CVE-2020-13822 has a medium severity rating due to its potential to cause ECDSA signature malleability.
How do I fix CVE-2020-13822?
To fix CVE-2020-13822, upgrade the Elliptic package to version 6.5.3 or later.
What versions are affected by CVE-2020-13822?
CVE-2020-13822 affects version 6.5.2 of the Elliptic package for Node.js.
What type of vulnerability is CVE-2020-13822?
CVE-2020-13822 is a signature malleability vulnerability related to ECDSA in the Elliptic library.
Can CVE-2020-13822 impact application security?
Yes, CVE-2020-13822 can impact application security if it relies on a single canonical ECDSA signature.