CVE-2020-13822: Integer Overflow
The Elliptic for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Other sources
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
— GitHub
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-13822?
CVE-2020-13822 has a medium severity rating due to its potential to cause ECDSA signature malleability.
How do I fix CVE-2020-13822?
To fix CVE-2020-13822, upgrade the Elliptic package to version 6.5.3 or later.
What versions are affected by CVE-2020-13822?
CVE-2020-13822 affects version 6.5.2 of the Elliptic package for Node.js.
What type of vulnerability is CVE-2020-13822?
CVE-2020-13822 is a signature malleability vulnerability related to ECDSA in the Elliptic library.
Can CVE-2020-13822 impact application security?
Yes, CVE-2020-13822 can impact application security if it relies on a single canonical ECDSA signature.