CVE-2024-42459: Elliptic signature malleability in EDDSA and ECDSA

CVE-2024-42459 · Severity: low · CVSS 3.1 · Published 2024-08-02

Elliptic is a widely-used cryptographic library for Node.js that implements digital signature algorithms. This vulnerability allows attackers to create multiple valid signatures for the same message by removing or appending zero bytes (EDDSA) or using improperly-encoded signatures (ECDSA), potentially bypassing signature verification checks in downstream applications and compromising authentication mechanisms.

Technologies: elliptic (npm). Vendors: npm.

Quick answers

Is CVE-2024-42459 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-42459 being exploited in the wild.
How severe is CVE-2024-42459?
Low severity, with a CVSS score of 3.1, published 2 August 2024.
Which products and versions are affected?
elliptic (npm) SEMVER:introduced=4.0.0,fixed=6.5.7.
Is there a fix for CVE-2024-42459?
Yes. elliptic (npm): upgrade to 6.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-42459 attacked?
It is attacked over the network.
Am I affected by CVE-2024-42459?
Check whether you run elliptic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • elliptic (npm): upgrade to 6.5.7 or later
    npm install elliptic@6.5.7

Technical details

The vulnerability stems from missing validation checks during signature decoding in both EDDSA and ECDSA implementations. For EDDSA, the signature verification does not enforce a strict length check, permitting zero-valued bytes to be removed or appended while remaining valid. For ECDSA, the DER encoding parser does not verify that r and s have zero leading bits (per ASN.1 spec) and incorrectly permits BER-encoded sequences with leading zeros in length fields. An attacker with the ability to craft or modify signatures can exploit this to create signature collisions. No authentication or user interaction is required; the vulnerability is triggered during signature verification by any application using affected versions. The fix was merged in version 6.5.7, which adds proper length and encoding validation during signature decoding.

Affected products

  • Elliptic elliptic 4.0.0 through 6.5.6

Identifiers

  • CVE-2024-42459
  • GHSA-f7q4-pwc6-w24p

Timeline

  • 2024-08-02: disclosed: Published in GitHub Advisory Database
  • 2024-08-14: patched: Fix merged in version 6.5.7 (PR #317)
  • 2024-07-18: other: Pull request submitted with test vectors from Wycheproof project

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.