CVE-2024-48948
Last modified
CVE-2024-48948 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Indutny | Elliptic | 6.5.7 |
References
- https://github.com/indutny/elliptic/issues/321Exploit, Issue Tracking
- https://github.com/indutny/elliptic/pull/322Exploit, Issue Tracking
- https://security.netapp.com/advisory/ntap-20241220-0004/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-48948?
How severe is CVE-2024-48948?
How do I fix CVE-2024-48948?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-48938Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.…7.5
- CVE-2024-48939Insufficient validation performed on the REST API License fi…7.5
- CVE-2024-4894ITPison OMICARD EDM fails to properly filter specific URL p…5.3
- CVE-2024-48941The Syracom Secure Login (2FA) plugin for Jira, Confluence, …5.4
- CVE-2024-48942The Syracom Secure Login (2FA) plugin for Jira, Confluence, …5.9
- CVE-2024-48944Server-Side Request Forgery (SSRF) vulnerability in Apache K…6.5
- CVE-2024-48949The verify function in lib/elliptic/eddsa/index.js in the El…9.1
- CVE-2024-4895The wpDataTables – WordPress Data Table, Dynamic Tables & Ta…4.7
- CVE-2024-48950An issue was discovered in Logpoint before 7.5.0. An endpoin…7.5
- CVE-2024-48951An issue was discovered in Logpoint before 7.5.0. Server-Sid…7.5
- CVE-2024-48952An issue was discovered in Logpoint before 7.5.0. SOAR uses …6.4
- CVE-2024-48953An issue was discovered in Logpoint before 7.5.0. Endpoints …7.5
Are you affected by CVE-2024-48948?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST