PT-2022-25818 · Unknown · Secp256K1-Js

Shilohshio · Published 2022-09-24 · Updated 2022-09-28 · CVE-2022-41340

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions secp256k1-js versions prior to 1.1.0

Description The issue is related to the implementation of ECDSA in the secp256k1-js package, which lacks required r and s validation. This omission can lead to signature forgery.

Recommendations For versions prior to 1.1.0, update to version 1.1.0 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2022-41340

GHSA-Q3F4-9H4P-VGR3

Affected Products

Secp256K1-Js

References · 11

• https://github.com/lionello/secp256k1-js/commit/302800f0370b42e360a33774bb808274ac729c2e · Patch
• https://github.com/lionello/secp256k1-js/compare/1.0.1...1.1.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41340 · Security Note
• https://osv.dev/vulnerability/GHSA-q3f4-9h4p-vgr3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41340 · Vendor Advisory
• https://github.com/lionello/secp256k1-js · Note
• https://github.com/lionello/secp256k1-js/issues/11 · Note
• https://npmjs.com/package/@lionello/secp256k1-js · Note
• https://npmjs.com/package/%40lionello/secp256k1-js · Note
• https://t.me/cvenotify/36794 · Telegram Post
• https://t.me/cvenotify/36784 · Telegram Post