CVE-2022-41340 : The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without requi

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.

Published 2022-09-24 19:15:09

Updated 2022-09-28 15:55:42

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-41340

Secp256k1-js Project » Secp256k1-js » For Node.js
Versions before (<) 1.1.0
cpe:2.3:a:secp256k1-js_project:secp256k1-js:*:*:*:*:*:node.js:*:*
Matching versions

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 38 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Assigned by: nvd@nist.gov (Primary)

https://github.com/lionello/secp256k1-js/issues/11

A security issue in ECDSA verify. · Issue #11 · lionello/secp256k1-js · GitHub
Issue Tracking;Third Party Advisory
https://github.com/lionello/secp256k1-js/compare/1.0.1...1.1.0

Comparing 1.0.1...1.1.0 · lionello/secp256k1-js · GitHub
Patch;Third Party Advisory
https://www.npmjs.com/package/@lionello/secp256k1-js

@lionello/secp256k1-js - npm
Product;Third Party Advisory
https://github.com/lionello/secp256k1-js/commit/302800f0370b42e360a33774bb808274ac729c2e

Fix #11: add parameter validation · lionello/secp256k1-js@302800f · GitHub
Patch;Third Party Advisory

Jump to