Cryptographic Issues
CVE-2020-28498

6.8MEDIUM

Key Information:

Vendor

Elliptic Project

Status
Elliptic
Vendor
CVE Published:
2 February 2021

What is CVE-2020-28498?

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

elliptic < 6.5.4

References

https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899
x_refsource_CONFIRM
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1069836
x_refsource_CONFIRM
https://github.com/christianlundkvist/blog/blob/master/20...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kyle Den Hartog
JSON
.