Описание
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 6.6.1+dfsg-1 |
| esm-apps/bionic | needs-triage | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | needs-triage | |
| esm-apps/noble | needs-triage | |
| focal | ignored | end of standard support, was needs-triage |
| jammy | needs-triage | |
| noble | needs-triage | |
| oracular | ignored | end of life, was needs-triage |
| plucky | not-affected | 6.6.1+dfsg-1 |
Показывать по
Ссылки на источники
EPSS
9.1 Critical
CVSS3
Связанные уязвимости
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
The verify function in lib/elliptic/eddsa/index.js in the Elliptic pac ...
Elliptic's verify function omits uniqueness validation
EPSS
9.1 Critical
CVSS3