SB2024091934 - Multiple vulnerabilities in elliptic library for Node.js

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-42459)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when handling EDDSA signatures. A remote attacker can bypass signature-based security checks.

2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-42460)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when handling ECDSA signatures. A remote attacker can bypass signature-based security checks.

3) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-42461)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when handling BER-encoded ECDSA signatures. A remote attacker can bypass signature-based security checks.

Remediation

Install update from vendor's website.

References

• https://github.com/indutny/elliptic/pull/317