Information Exposure Affecting ecdh package, versions <0.2.0
Threat Intelligence
EPSS
0.21% (59th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-ECDH-3331939
- published 26 Feb 2023
- disclosed 26 Feb 2023
- credit shilohshi
Introduced: 26 Feb 2023
CVE-2022-44310 Open this link in a new tabHow to fix?
Upgrade ecdh to version 0.2.0 or higher.
Overview
ecdh is a native Node.js module for ECDH and ECDSA
Affected versions of this package are vulnerable to Information Exposure in the deriveSharedSecret() function in index.js, which allows an attacker to send an invalid point as the public key (a point not on the curve), and retrieve the derived shared secret.
References
CVSS Scores
version 3.1