Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Need to update package "elliptic" because it has vulnerabilities #4878

Open
IvanKodak opened this issue Nov 5, 2024 · 2 comments
Open

Need to update package "elliptic" because it has vulnerabilities #4878

IvanKodak opened this issue Nov 5, 2024 · 2 comments
Labels
enhancement New feature or improvement. minor-bump Planned for the next minor version bump. next-patch Issues scheduled for the next arch release. on-deck This Enhancement or Bug is currently being worked on. v5 Issues regarding legacy-v5

Comments

@IvanKodak
Copy link

Describe the Feature

Update please package elliptic, because the version that are using has vulnerabilities:

Screenshot 2024-11-05 at 15 17 29

Elliptic's EDDSA missing signature length check - GHSA-f7q4-pwc6-w24p
Elliptic's ECDSA missing check for whether lead
ing bit of r and s is zero - GHSA-977x-g7h5-7qgw
Elliptic allows BER-encoded signatures - GHSA-49q7-c7j4-3p7m
Elliptic's verify function omits uniqueness validation - GHSA-434g-2637-qmqr
Valid ECDSA signatures erroneously rejected in Elliptic - GHSA-fc9h-whq2-v747

Code Example

No response
@IvanKodak IvanKodak added the enhancement New feature or improvement. label Nov 5, 2024
@IvanKodak
Copy link
Author

@ricmoo please check

@daveroga daveroga mentioned this issue Nov 6, 2024
Merged
@ricmoo
Copy link
Member

ricmoo commented Dec 3, 2024

This is being investigated for v5 right now. Thanks!

@ricmoo ricmoo added on-deck This Enhancement or Bug is currently being worked on. minor-bump Planned for the next minor version bump. v5 Issues regarding legacy-v5 next-patch Issues scheduled for the next arch release. labels Dec 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or improvement. minor-bump Planned for the next minor version bump. next-patch Issues scheduled for the next arch release. on-deck This Enhancement or Bug is currently being worked on. v5 Issues regarding legacy-v5
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ricmoo @IvanKodak