{"action":"Upgrade secp256k1 to 3.8.1 or later.","affected":[{"fixed":"5.0.1","introduced":"5.0.0"},{"fixed":"4.0.4","introduced":"4.0.0"},{"fixed":"3.8.1","introduced":"0"}],"component":"secp256k1","cve_ids":["CVE-2024-48930"],"ecosystem":"npm","epss":0.00406,"exploited":false,"fixed_versions":["5.0.1","4.0.4","3.8.1"],"ghsa_id":"GHSA-584q-6j8j-r5pm","id":"tcs_01M5KF302DN18M7Q7MMTAPY72R","modified_at":"2024-10-21T19:09:41Z","published_at":"2024-10-21T17:28:26Z","references":["https://osv.dev/vulnerability/GHSA-584q-6j8j-r5pm","https://github.com/cryptocoinjs/secp256k1-node/security/advisories/GHSA-584q-6j8j-r5pm","https://nvd.nist.gov/vuln/detail/CVE-2024-48930","https://github.com/cryptocoinjs/secp256k1-node/commit/8bd6446e000fa59df3cda0ae3e424300747ea5ed","https://github.com/cryptocoinjs/secp256k1-node/commit/9a15fff274f83a6ec7f675f1121babcc0c42292f","https://github.com/cryptocoinjs/secp256k1-node/commit/e256905ee649a7caacc251f7c964667195a52221","https://github.com/cryptocoinjs/secp256k1-node","https://github.com/cryptocoinjs/secp256k1-node/blob/6d3474b81d073cc9c8cc8cfadb580c84f8df5248/lib/elliptic.js#L17-L19","https://github.com/cryptocoinjs/secp256k1-node/blob/6d3474b81d073cc9c8cc8cfadb580c84f8df5248/lib/elliptic.js#L37-L39"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-584q-6j8j-r5pm","url":"https://osv.dev/vulnerability/GHSA-584q-6j8j-r5pm"},{"source":"nvd","source_id":"CVE-2024-48930","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48930"}],"summary":"secp256k1-node allows private key extraction over ECDH"}