Skip to content
Fencer Vulns
medium 4.8

CVE-2024-48948 json

Valid ECDSA signatures erroneously rejected in Elliptic

published 2024-10-15 2 y ago modified 2026-06-17 4 mo ago also GHSA-fc9h-whq2-v747 , EUVD-2024-3034

cvss
4.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.

Patch / fix

  • npm elliptic 6.6.0
  • node-elliptic Debian 14, Debian 13 6.6.1+dfsg-1

debian advisories DEBIAN-CVE-2024-48948

  • aws-cli SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 1.33.26-150400.34.7.1
  • python-boto3 SLE Module for Python 3 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 1.34.138-150400.27.7.1
  • python-flaky openSUSE Leap 15.6 3.8.1-150400.14.6.1
  • python-pluggy SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 1.5.0-150400.14.10.1
  • python-pytest SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 8.3.5-150400.3.9.1
  • python-botocore SLE Module for Python 3 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 1.34.144-150400.41.7.1
  • python-coverage SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +9 more 7.6.10-150400.12.6.1
  • python-pytest-cov SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 6.2.1-150400.12.6.1

suse advisories SUSE-SU-2025:3744-1SUSE-SU-2024:3771-1

  • python-pytest-html openSUSE Tumbleweed 4.2.0-4.1
  • velociraptor openSUSE Tumbleweed 0.7.0.4.git142.862ef23-1.1
  • python-pytest-html openSUSE Tumbleweed 4.1.1-3.1

opensuse advisories openSUSE-SU-2026:11220-1openSUSE-SU-2025:14663-1openSUSE-SU-2024:14433-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-48948 updated cvss 3.7

elliptic: ECDSA signature verification error may reject legitimate transactions

  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/multicluster-engine-console-mce-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8 Red Hat Developer Hub 1 rhdh-operator-container
    affected: no fix available “Fix deferred”
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-console-plugin-rhel8 Red Hat 3scale API Management Platform 2 3scale-amp-system-container Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 7 thunderbird Red Hat Enterprise Linux 8 pcs, grafana, mozjs60, pcs-snmp, grafana-loki, grafana-mssql, +11 more
    +6 more products
    Red Hat Enterprise Linux 9 gjs, pcs, polkit, pcs-snmp, polkit-libs Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8 Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8, devspaces/dashboard-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/argo-rollouts-rhel8 Red Hat Quay 3 quay/quay-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/indutny/elliptic/pull/322 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/indutny/elliptic/issues/321 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CNA 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
GitHub 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm elliptic
<6.6.0
6.6.0

Affected products

  • nodejs elliptic

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.