CVE-2024-48948 (Medium) detected in multiple libraries

[mend-bolt-for-github]

CVE-2024-48948 - Medium Severity Vulnerability

Vulnerable Libraries - elliptic-6.4.1.tgz, elliptic-6.5.4.tgz, elliptic-6.5.1.tgz, elliptic-6.4.0.tgz, elliptic-6.5.3.tgz

elliptic-6.4.1.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.4.1.tgz

Path to dependency file: /aws-node-typescript-nest/package.json

Path to vulnerable library: /aws-node-typescript-nest/node_modules/elliptic/package.json,/aws-node-github-check/node_modules/elliptic/package.json,/aws-node-fullstack/frontend/node_modules/elliptic/package.json

Dependency Hierarchy:

• react-scripts-2.1.8.tgz (Root Library)
  • webpack-4.28.3.tgz
    • node-libs-browser-2.2.0.tgz
      • crypto-browserify-3.12.0.tgz
        • create-ecdh-4.0.3.tgz
          • ❌ elliptic-6.4.1.tgz (Vulnerable Library)

elliptic-6.5.4.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz

Path to dependency file: /aws-node-vue-nuxt-ssr/package.json

Path to vulnerable library: /aws-node-vue-nuxt-ssr/node_modules/elliptic/package.json,/azure-node-telegram-bot/node_modules/elliptic/package.json,/aws-node-signed-uploads/node_modules/elliptic/package.json,/aws-node-auth0-cognito-custom-authorizers-api/node_modules/elliptic/package.json,/aws-node-dynamic-image-resizer/node_modules/elliptic/package.json,/azure-node-line-bot/node_modules/elliptic/package.json

Dependency Hierarchy:

• nuxt-2.15.8.tgz (Root Library)
  • webpack-2.15.8.tgz
    • webpack-4.46.0.tgz
      • node-libs-browser-2.2.1.tgz
        • crypto-browserify-3.12.0.tgz
          • create-ecdh-4.0.4.tgz
            • ❌ elliptic-6.5.4.tgz (Vulnerable Library)

elliptic-6.5.1.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.1.tgz

Path to dependency file: /aws-node-typescript-sqs-standard/package.json

Path to vulnerable library: /aws-node-typescript-sqs-standard/node_modules/elliptic/package.json,/aws-node-typescript-kinesis/node_modules/elliptic/package.json

Dependency Hierarchy:

• webpack-4.41.2.tgz (Root Library)
  • node-libs-browser-2.2.1.tgz
    • crypto-browserify-3.12.0.tgz
      • create-ecdh-4.0.3.tgz
        • ❌ elliptic-6.5.1.tgz (Vulnerable Library)

elliptic-6.4.0.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.4.0.tgz

Path to dependency file: /aws-node-oauth-dropbox-api/package.json

Path to vulnerable library: /aws-node-oauth-dropbox-api/node_modules/elliptic/package.json

Dependency Hierarchy:

• serverless-plugin-optimize-3.0.3-rc.1.tgz (Root Library)
  • browserify-14.5.0.tgz
    • crypto-browserify-3.12.0.tgz
      • create-ecdh-4.0.3.tgz
        • ❌ elliptic-6.4.0.tgz (Vulnerable Library)

elliptic-6.5.3.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.3.tgz

Path to dependency file: /azure-node-typescript-servicebus-trigger-endpoint/package.json

Path to vulnerable library: /azure-node-typescript-servicebus-trigger-endpoint/node_modules/elliptic/package.json

Dependency Hierarchy:

• webpack-4.44.2.tgz (Root Library)
  • node-libs-browser-2.2.1.tgz
    • crypto-browserify-3.12.0.tgz
      • create-ecdh-4.0.4.tgz
        • ❌ elliptic-6.5.3.tgz (Vulnerable Library)

Found in HEAD commit: dcbe4aefe4b3685f4b15493a01db0f19b118a0c4

Found in base branch: master

Vulnerability Details

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.

Publish Date: 2024-10-15

URL: CVE-2024-48948

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fc9h-whq2-v747

Release Date: 2024-10-28

Fix Resolution: elliptic - 6.6.0

---

Step up your Open Source Security Game with Mend here