Bug 1848647 (CVE-2020-13822) - CVE-2020-13822 nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures
Summary: CVE-2020-13822 nodejs-elliptic: improper encoding checks allows a certain deg...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-13822
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1851500 1851501 1851502 1851812 1851832 1851833 1852621
Blocks: 1848648
TreeView+ depends on / blocked
 
Reported: 2020-06-18 16:41 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-06-07 15:00 UTC (History)
32 users (show)

See Also:
Fixed In Version: nodejs-elliptic 6.5.3
Doc Type: If docs needed, set a value
Doc Text:
The Elliptic for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Clone Of:
Environment:
Last Closed: 2020-10-27 20:21:16 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4298 0 None None None 2020-10-27 16:24:25 UTC
Red Hat Product Errata RHSA-2020:5533 0 None None None 2020-12-15 17:14:21 UTC

Description Guilherme de Almeida Suckevicz 2020-06-18 16:41:40 UTC 
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Reference:
https://github.com/indutny/elliptic/issues/226
Comment 5 Mark Cooper 2020-06-29 05:53:57 UTC 
Upstream commit: https://github.com/indutny/elliptic/commit/856fe4d99fe7b6200556e6400b3bf585b1721bec
Comment 8 Mark Cooper 2020-06-30 03:37:46 UTC 
External References:

https://snyk.io/vuln/SNYK-JS-ELLIPTIC-571484
Comment 10 errata-xmlrpc 2020-10-27 16:24:19 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2020:4298 https://access.redhat.com/errata/RHSA-2020:4298
Comment 11 Product Security DevOps Team 2020-10-27 20:21:16 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-13822
Comment 14 errata-xmlrpc 2020-12-15 17:14:44 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2020:5533 https://access.redhat.com/errata/RHSA-2020:5533
Comment 15 Jason Shepherd 2021-03-22 01:13:58 UTC 
Statement:

In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers don't use the vulnerable elliptic library for authentication (OpenShift OAuth is used) or traffic communications (OpenShift route is used). Therefore the impact for OCP and OSSM is Low.

Red Hat Quay includes nodejs-elliptic as a dependency of webpack. That dependency is only used at development time, not runtime. Therefore this vulnerability is rated low for Red Hat Quay.
Note You need to log in before you can comment on or make changes to this bug.