VDB
Sign up
MEDIUM5.3

GHSA-49q7-c7j4-3p7m

Elliptic allows BER-encoded signatures

Quick fix

GHSA-49q7-c7j4-3p7m — elliptic: upgrade to the fixed version with the command below.

npm install elliptic@6.5.7

Details

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/elliptic
Introduced in: 5.2.1Fixed in: 6.5.7
Fixnpm install elliptic@6.5.7

References