Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Need to update package "elliptic" because it has vulnerabilities #4878

Open
IvanKodak opened this issue Nov 5, 2024 · 1 comment
Open

Need to update package "elliptic" because it has vulnerabilities #4878

IvanKodak opened this issue Nov 5, 2024 · 1 comment
Labels
enhancement New feature or improvement.

Comments

@IvanKodak
Copy link

Describe the Feature

Update please package elliptic, because the version that are using has vulnerabilities:

Screenshot 2024-11-05 at 15 17 29

Elliptic's EDDSA missing signature length check - GHSA-f7q4-pwc6-w24p
Elliptic's ECDSA missing check for whether lead
ing bit of r and s is zero - GHSA-977x-g7h5-7qgw
Elliptic allows BER-encoded signatures - GHSA-49q7-c7j4-3p7m
Elliptic's verify function omits uniqueness validation - GHSA-434g-2637-qmqr
Valid ECDSA signatures erroneously rejected in Elliptic - GHSA-fc9h-whq2-v747

Code Example

No response

@IvanKodak IvanKodak added the enhancement New feature or improvement. label Nov 5, 2024
@IvanKodak
Copy link
Author

@ricmoo please check

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or improvement.
Projects
None yet
Development

No branches or pull requests

1 participant