Bug 1848647 (CVE-2020-13822)

Summary:	CVE-2020-13822 nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboyko, alegrand, anpicker, bdettelb, bmontgom, chazlett, drieden, eparis, erooth, gparvin, jburrell, jokerman, jramanat, jweiser, kakkoyun, kconner, krathod, lcosic, mloibl, nstielau, pdrozd, pjindal, pkrupa, rcernich, sisharma, sponnaga, stcannon, sthorger, surbania, tfister, thee, tomckay
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
See Also:	https://issues.redhat.com/browse/MAISTRA-1600 https://issues.redhat.com/browse/MAISTRA-1601 https://issues.redhat.com/browse/KEYCLOAK-16593
Whiteboard:
Fixed In Version:	nodejs-elliptic 6.5.3	Doc Type:	If docs needed, set a value
Doc Text:	The Elliptic for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-10-27 20:21:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1851500, 1851501, 1851502, 1851812, 1851832, 1851833, 1852621
Bug Blocks:	1848648

Description Guilherme de Almeida Suckevicz 2020-06-18 16:41:40 UTC

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Reference:
https://github.com/indutny/elliptic/issues/226

Comment 5 Mark Cooper 2020-06-29 05:53:57 UTC

Upstream commit: https://github.com/indutny/elliptic/commit/856fe4d99fe7b6200556e6400b3bf585b1721bec

Comment 8 Mark Cooper 2020-06-30 03:37:46 UTC

External References:

https://snyk.io/vuln/SNYK-JS-ELLIPTIC-571484

Comment 10 errata-xmlrpc 2020-10-27 16:24:19 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2020:4298 https://access.redhat.com/errata/RHSA-2020:4298

Comment 11 Product Security DevOps Team 2020-10-27 20:21:16 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-13822

Comment 14 errata-xmlrpc 2020-12-15 17:14:44 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2020:5533 https://access.redhat.com/errata/RHSA-2020:5533

Comment 15 Jason Shepherd 2021-03-22 01:13:58 UTC

Statement:

In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers don't use the vulnerable elliptic library for authentication (OpenShift OAuth is used) or traffic communications (OpenShift route is used). Therefore the impact for OCP and OSSM is Low.

Red Hat Quay includes nodejs-elliptic as a dependency of webpack. That dependency is only used at development time, not runtime. Therefore this vulnerability is rated low for Red Hat Quay.