Количество 4
Количество 4
CVE-2026-4258
Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH outputs. The dhJavaEc() function directly returns the raw x-coordinate of the scalar multiplication result (no hashing), providing a plaintext oracle without requiring any decryption feedback.
CVE-2026-4258
Versions of the package sjcl before 1.0.9 are vulnerable to Improper V ...
GHSA-2w8x-224x-785m
sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey
BDU:2026-11303
Уязвимость функции sjcl.ecc.basicKey.publicKey() криптографической библиотеки SJCL (Stanford JavaScript Crypto Library), позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-4258 Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH outputs. The dhJavaEc() function directly returns the raw x-coordinate of the scalar multiplication result (no hashing), providing a plaintext oracle without requiring any decryption feedback. | CVSS3: 7.5 | 0% Низкий | 6 месяцев назад |
| CVE-2026-4258 Versions of the package sjcl before 1.0.9 are vulnerable to Improper V ... | CVSS3: 7.5 | 0% Низкий | 6 месяцев назад |
| GHSA-2w8x-224x-785m sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey | CVSS3: 7.5 | 0% Низкий | 6 месяцев назад |
 | BDU:2026-11303 Уязвимость функции sjcl.ecc.basicKey.publicKey() криптографической библиотеки SJCL (Stanford JavaScript Crypto Library), позволяющая нарушителю получить несанкционированный доступ к защищаемой информации | CVSS3: 7.5 | 0% Низкий | 6 месяцев назад |
Уязвимостей на страницу