CVE-2025-14505: Elliptic Cryptanalysis vulnerability when `k` has leading zeros
The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14505?
CVE-2025-14505 is classified as a high severity vulnerability due to its potential to expose secret keys through cryptanalysis of incorrect ECDSA signatures.
How do I fix CVE-2025-14505?
To fix CVE-2025-14505, upgrade the elliptic package to version 6.6.2 or later, which resolves the incorrect signature generation.
What versions are affected by CVE-2025-14505?
CVE-2025-14505 affects elliptic package versions up to and including 6.6.1.
What are the consequences of exploiting CVE-2025-14505?
Exploiting CVE-2025-14505 could lead to the exposure of private keys, compromising the security of cryptographic operations.
How does CVE-2025-14505 impact ECDSA signature generation?
CVE-2025-14505 impacts ECDSA signature generation by producing incorrect signatures when the interim value of 'k' has leading zeros, making it vulnerable to attacks.