{"id":"CVE-2024-42459","published":"2024-08-02T00:00:00Z","modified":"2025-11-03T22:04:51Z","title":"In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature…","vendor":null,"product":null,"tier":"tail","description":{"text":"In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00302,"percentile":0.22948,"provenance":"source"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"references":[{"url":"https://github.com/indutny/elliptic/pull/317","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20241004-0005/","tags":[]}],"priority":{"score":8.3,"factors":[{"name":"EPSS percentile","points":4.59},{"name":"CVSS severity","points":3.71}]},"affected":[{"ecosystem":"npm","package":"elliptic","vulnerableRanges":[">=4.0.0, <6.5.7"],"patched":["6.5.7"],"from":["GHSA-f7q4-pwc6-w24p"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2570","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-13822","published":"2020-06-04","fixed":"6.5.3","kev":false},{"cve":"CVE-2020-28498","published":"2021-02-02","fixed":"6.5.4","kev":false},{"cve":"CVE-2024-48949","published":"2024-10-10","fixed":"6.5.6","kev":false},{"cve":"CVE-2024-42459","published":"2024-08-02","fixed":"6.5.7","kev":false},{"cve":"CVE-2024-42460","published":"2024-08-02","fixed":"6.5.7","kev":false},{"cve":"CVE-2024-42461","published":"2024-08-02","fixed":"6.5.7","kev":false},{"cve":"CVE-2024-48948","published":"2024-10-15","fixed":"6.6.0","kev":false,"link":{"from":"CVE-2024-42459","to":"CVE-2024-48948","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:elliptic","fromFixed":"6.5.7","toFixed":"6.6.0","daysApart":74}]}}],"package":"npm:elliptic"}}