CVE-2024-48948 - Elliptic Node.js ECDSA Signature Validation Bypass

CVE ID : CVE-2024-48948
Published : Oct. 15, 2024, 2:15 p.m. | 24 minutes ago
Description : The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...