CVE-2024-42461

elliptic: nodejs/elliptic: ECDSA implementation malleability due to BER-enconded signatures being allowed

Published Aug 2, 2024 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-49q7-c7j4-3p7m Elliptic allows BER-encoded signatures
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.8::el8
cpe:/a:redhat:multicluster_engine:2.3::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.9::el8
cpe:/a:redhat:multicluster_engine:2.4::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine:2.6::el8
cpe:/a:redhat:multicluster_engine:2.6::el9
Type Values Removed Values Added
First Time appeared Redhat acm
CPEs cpe:/a:redhat:acm:2.10::el9
Vendors & Products Redhat acm
Type Values Removed Values Added
First Time appeared Redhat multicluster Engine
CPEs cpe:/a:redhat:multicluster_engine:2.5::el8
Vendors & Products Redhat multicluster Engine
Type Values Removed Values Added
First Time appeared Redhat
Redhat service Mesh
CPEs cpe:/a:redhat:service_mesh:2.4::el8
cpe:/a:redhat:service_mesh:2.5::el8
Vendors & Products Redhat
Redhat service Mesh
Type Values Removed Values Added
First Time appeared Elliptic Project
Elliptic Project elliptic
Weaknesses CWE-347
CPEs cpe:2.3:a:elliptic_project:elliptic:6.5.6:*:*:*:*:node.js:*:*
Vendors & Products Elliptic Project
Elliptic Project elliptic
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Title elliptic: nodejs/elliptic: From NVD collector elliptic: nodejs/elliptic: ECDSA implementation malleability due to BER-enconded signatures being allowed
Weaknesses CWE-325
Type Values Removed Values Added
Title elliptic: From NVD collector elliptic: nodejs/elliptic: From NVD collector
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Nov 3, 2025, 10:04 PM
Reserved
Aug 2, 2024, 12:00 AM
Status
Modified
Published
Aug 2, 2024, 7:16 AM
Modified
Jun 17, 2026, 7:49 AM
Severity
Moderate
Public date
Aug 2, 2024, 12:00 AM