CVE-2024-48948: Medium severity ibm cognos analytics vulnerability
The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.
Other sources
The Elliptic prior to 6.6.0 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-48948?
CVE-2024-48948 has a high severity due to the potential for signature verification bypass in elliptic curve cryptography.
How do I fix CVE-2024-48948?
To fix CVE-2024-48948, update the Elliptic package to version 6.6.0 or later.
What software is affected by CVE-2024-48948?
CVE-2024-48948 affects the Elliptic package version 6.5.7 for Node.js and IBM Cognos Analytics Mobile (iOS) up to version 1.1.
What vulnerability does CVE-2024-48948 address?
CVE-2024-48948 addresses a flaw in the ECDSA implementation of the Elliptic package that improperly verifies signatures with specific hash characteristics.
Is CVE-2024-48948 actively exploited?
There is currently no public indication that CVE-2024-48948 is being actively exploited, but its vulnerabilities should be addressed as a precaution.