CVE-2024-48948

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-48948
The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/indutny/elliptic/issues/321 Exploit Issue Tracking
https://github.com/indutny/elliptic/pull/322 Exploit Issue Tracking
https://security.netapp.com/advisory/ntap-20241220-0004/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:indutny:elliptic:6.5.7:*:*:*:*:node.js:*:*
History

20 Jun 2025, 16:18

Type Values Removed Values Added
References () https://github.com/indutny/elliptic/issues/321 - () https://github.com/indutny/elliptic/issues/321 - Exploit, Issue Tracking
References () https://github.com/indutny/elliptic/pull/322 - () https://github.com/indutny/elliptic/pull/322 - Exploit, Issue Tracking
References () https://security.netapp.com/advisory/ntap-20241220-0004/ - () https://security.netapp.com/advisory/ntap-20241220-0004/ - Third Party Advisory
CPE cpe:2.3:a:indutny:elliptic:6.5.7:*:*:*:*:node.js:*:*
First Time Indutny elliptic
Indutny

20 Dec 2024, 13:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20241220-0004/ -

05 Nov 2024, 19:36

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.8
CWE CWE-347

16 Oct 2024, 16:38

Type Values Removed Values Added
Summary
  • (es) El paquete Elliptic 6.5.7 para Node.js, en su implementación para ECDSA, no verifica correctamente las firmas válidas si el hash contiene al menos cuatro bytes 0 iniciales y cuando el orden del punto base de la curva elíptica es menor que el hash, debido a una anomalía _truncateToN. Esto hace que se rechacen firmas válidas. Las transacciones o comunicaciones legítimas pueden marcarse incorrectamente como no válidas.

15 Oct 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-15 14:15

Updated : 2025-06-20 16:18

NVD link : CVE-2024-48948

Mitre link : CVE-2024-48948

CVE.ORG link : CVE-2024-48948

JSON object : View

Products Affected

indutny

  • elliptic
CWE
CWE-347

Improper Verification of Cryptographic Signature