CVE-2024-42461

A flaw was found in the Elliptic package for Node.js. ECDSA signatures encoded in BER format are improperly validated, allowing leading zeros to be added to the signature without invalidating it, resulting in confidentiality issues.

This vulnerability was found in the elliptic npm package, it is an Improper Verification of Cryptographic Signature that occurs because the library accepts non-strictly BER-encoded signatures.This allows an attacker to create another valid signature for the same message, which may cause issues in systems that rely on unique signatures for identifying transactions.The overall impact on confidentiality is low.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.