Omitting validation in verify function in lib/elliptic/eddsa/index.js

CVE-2024-48949

What is CVE-2024-48949?

A vulnerability exists in the verify function of the Elliptic package utilized within Node.js prior to version 6.5.6. This issue arises due to a lack of essential validation checks for digital signatures, specifically concerning the conditions "sig.S().gte(sig.eddsa.curve.n)" and "sig.S().isNeg()". As a result, the absence of these validations could potentially allow for improper verification of digital signatures, posing security risks to applications relying on this cryptographic library.

References