CVE-2020-28498: Cryptographic Issues
The npm package elliptic before version 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.
Other sources
The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-28498?
CVE-2020-28498 has a medium severity rating due to its potential for cryptographic exploitation.
How do I fix CVE-2020-28498?
To fix CVE-2020-28498, update the elliptic package to version 6.5.4 or later.
What software is affected by CVE-2020-28498?
CVE-2020-28498 affects the elliptic package versions prior to 6.5.4.
What type of vulnerability is CVE-2020-28498?
CVE-2020-28498 is identified as a cryptographic issue related to the secp256k1 implementation.
Can CVE-2020-28498 lead to security breaches?
Yes, CVE-2020-28498 can lead to security breaches if the public key point is not properly validated.