CVE-2024-42460

elliptic: nodejs/elliptic: ECDSA signature malleability due to missing checks

Published Aug 2, 2024 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-977x-g7h5-7qgw Elliptic's ECDSA missing check for whether leading bit of r and s is zero
History
Type Values Removed Values Added
Metrics epss

{'score': 0.0014}

epss

{'score': 0.00152}

Type Values Removed Values Added
First Time appeared Indutny
Indutny elliptic
CPEs cpe:2.3:a:indutny:elliptic:6.5.6:*:*:*:*:node.js:*:*
Vendors & Products Indutny
Indutny elliptic
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.8::el8
cpe:/a:redhat:multicluster_engine:2.3::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.9::el8
cpe:/a:redhat:multicluster_engine:2.4::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine:2.6::el8
cpe:/a:redhat:multicluster_engine:2.6::el9
Type Values Removed Values Added
First Time appeared Redhat acm
CPEs cpe:/a:redhat:acm:2.10::el9
Vendors & Products Redhat acm
Type Values Removed Values Added
First Time appeared Redhat multicluster Engine
CPEs cpe:/a:redhat:multicluster_engine:2.5::el8
Vendors & Products Redhat multicluster Engine
Type Values Removed Values Added
First Time appeared Redhat
Redhat service Mesh
CPEs cpe:/a:redhat:service_mesh:2.4::el8
cpe:/a:redhat:service_mesh:2.5::el8
Vendors & Products Redhat
Redhat service Mesh
Type Values Removed Values Added
Title elliptic: From NVD collector elliptic: nodejs/elliptic: ECDSA signature malleability due to missing checks
Weaknesses CWE-325
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Nov 3, 2025, 10:04 PM
Reserved
Aug 2, 2024, 12:00 AM
Status
Modified
Published
Aug 2, 2024, 7:16 AM
Modified
Jun 17, 2026, 7:49 AM
Severity
Moderate
Public date
Aug 2, 2024, 12:00 AM