CVE-2020-13822: elliptic ECDSA signature malleability via encoding variations

CVE-2020-13822 · Severity: low · CVSS 3.1 · Published 2020-07-29

The elliptic library is a widely-used cryptographic library for Node.js that implements elliptic curve operations, including ECDSA signature verification. An application relying on ECDSA signatures for transaction validation, blockchain operations, or cryptographic authentication could be vulnerable to signature malleability attacks, where an attacker crafts alternative encodings of valid signatures that pass verification but weren't created by the legitimate signer. This could enable unauthorized transactions, key theft, or account takeovers depending on how signatures are used.

Technologies: elliptic (npm). Vendors: npm.

Quick answers

Is CVE-2020-13822 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-13822 being exploited in the wild.
How severe is CVE-2020-13822?
Low severity, with a CVSS score of 3.1, published 29 July 2020.
Which products and versions are affected?
elliptic (npm) SEMVER:introduced=0,fixed=6.5.3.
Is there a fix for CVE-2020-13822?
Yes. elliptic (npm): upgrade to 6.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-13822 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-13822?
Check whether you run elliptic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • elliptic (npm): upgrade to 6.5.3 or later
    npm install elliptic@6.5.3

Technical details

The vulnerability is a signature malleability issue in ECDSA verification within the elliptic library (versions before 6.5.3). The root cause is insufficient encoding validation: the library accepts ECDSA signatures that deviate from strict DER encoding standards, including long-form length encoding, leading zeros in length fields, and integer overflow conditions in ASN.1 parsing. An attacker can craft multiple distinct byte sequences representing the same (r, s) signature pair that all pass verification, violating the principle of canonical signatures. The attack requires network access to trigger signature verification on attacker-controlled input (no authentication required). This could enable double-spending in blockchain systems or key recovery in applications that assume signature uniqueness. The fix was released in version 6.5.3 with proper ASN.1 encoding validation.

Affected products

  • elliptic elliptic before 6.5.3

Identifiers

  • CVE-2020-13822
  • GHSA-vh7m-p724-62c2

Timeline

  • 2020-07-29: disclosed
  • 2020-07-29: patched: Fixed in version 6.5.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.