You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Based on the fact that this PR from one actual dependency with this issue hasn't been merged since 2021, browserify might be dead browserify/createECDH#20
The other library with this dependency is https://github.com/browserify/crypto-browserify and doesn't even have an issue filed for it. Maybe this ticket should be to move off of browserify.
Is your feature request related to a problem? Please describe.
Snyk found multiple vulns in Elliptic.
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
Describe the solution you'd like
Bump to >= 6.5.7
The text was updated successfully, but these errors were encountered: