PT-2025-7253 · Elliptic · Elliptic

Published 2025-02-12 · Updated 2025-02-12

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions: elliptic (affected versions not specified)

Description: The issue allows for private key extraction from ECDSA signatures when signing a malformed input, such as a string or a number, which could come from JSON network input. This is possible because the elliptic library accepts hex strings as one of the possible input types. The vulnerability can be exploited by constructing a malicious message that can be signed, leading to the reuse of the k value and ultimately allowing for private key extraction. The attack requires only a single malicious message to be signed for full key extraction. The estimated number of potentially affected devices worldwide is not available.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-VJH7-7G9H-FJFH

Affected Products

Elliptic

References · 4

• https://osv.dev/vulnerability/GHSA-vjh7-7g9h-fjfh · Vendor Advisory
• https://github.com/indutny/elliptic · Note
• https://github.com/indutny/elliptic/commit/04cb6f54ce552b3ebde6be06d6050419e1c7333e · Note
• https://github.com/indutny/elliptic/security/advisories/GHSA-vjh7-7g9h-fjfh · Note