CVE-2024-48949

elliptic: Missing Validation in Elliptic's EDDSA Signature Verification

Published Oct 10, 2024 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-434g-2637-qmqr Elliptic's verify function omits uniqueness validation
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00102}

epss

{'score': 0.00083}

Type Values Removed Values Added
First Time appeared Redhat openshift Devspaces
CPEs cpe:/a:redhat:openshift_devspaces:3::el8
Vendors & Products Redhat openshift Devspaces
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.8::el8
cpe:/a:redhat:multicluster_engine:2.3::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.12::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.10::el9
cpe:/a:redhat:multicluster_engine:2.5::el8
Type Values Removed Values Added
First Time appeared Redhat multicluster Engine
CPEs cpe:/a:redhat:acm:2.9::el8
cpe:/a:redhat:multicluster_engine:2.4::el8
cpe:/a:redhat:rhel_aus:8.2
Vendors & Products Redhat multicluster Engine
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_tus:8.4
Vendors & Products Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Tus
Type Values Removed Values Added
First Time appeared Indutny
Indutny elliptic
CPEs cpe:2.3:a:indutny:elliptic:*:*:*:*:*:node.js:*:*
Vendors & Products Indutny
Indutny elliptic
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Redhat
Redhat acm
CPEs cpe:/a:redhat:acm:2.11::el9
Vendors & Products Redhat
Redhat acm
Type Values Removed Values Added
Weaknesses CWE-347
Type Values Removed Values Added
Title elliptic: Missing Validation in Elliptic's EDDSA Signature Verification
References
Metrics threat_severity

None

cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

threat_severity

Important

Type Values Removed Values Added
Description The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Nov 25, 2025, 3:42 PM
Reserved
Oct 10, 2024, 12:00 AM
Status
Modified
Published
Oct 10, 2024, 1:15 AM
Modified
Jun 17, 2026, 7:59 AM
Severity
Important
Public date
Oct 10, 2024, 12:00 AM