CVE-2024-48930
1 advisory.
npm/secp256k1 CVE-2024-48930: high 8.7, EPSS 0.41%
secp256k1-node allows private key extraction over ECDH
Action: Upgrade secp256k1 to 3.8.1 or later.
npm i secp256k1@5.0.1npm i secp256k1@4.0.4npm i secp256k1@3.8.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 5.0.1 | - |
| 4.0.0 | 4.0.4 | - |
| 0 | 3.8.1 | - |
Fixed versions
| 5.0.1 | 4.0.4 | 3.8.1 |
Sources
- osv: GHSA-584q-6j8j-r5pm
- nvd: CVE-2024-48930
- https://github.com/cryptocoinjs/secp256k1-node/security/advisories/GHSA-584q-6j8j-r5pm
- https://github.com/cryptocoinjs/secp256k1-node/commit/8bd6446e000fa59df3cda0ae3e424300747ea5ed
- https://github.com/cryptocoinjs/secp256k1-node/commit/9a15fff274f83a6ec7f675f1121babcc0c42292f
- https://github.com/cryptocoinjs/secp256k1-node/commit/e256905ee649a7caacc251f7c964667195a52221
- https://github.com/cryptocoinjs/secp256k1-node
- https://github.com/cryptocoinjs/secp256k1-node/blob/6d3474b81d073cc9c8cc8cfadb580c84f8df5248/lib/elliptic.js#L17-L19
- https://github.com/cryptocoinjs/secp256k1-node/blob/6d3474b81d073cc9c8cc8cfadb580c84f8df5248/lib/elliptic.js#L37-L39
CVE-2024-48930 · published · modified · JSON