Improper Verification of Cryptographic Signature #60

Package Manager: npm
Vulnerable module: elliptic
Introduced through: node-polyfill-webpack-plugin@4.1.0 and others
Detailed paths

node-polyfill-webpack-plugin@4.1.0 › node-stdlib-browser@1.3.1 › crypto-browserify@3.12.1 › browserify-sign@4.2.3 › elliptic@6.6.1

node-polyfill-webpack-plugin@4.1.0 › node-stdlib-browser@1.3.1 › crypto-browserify@3.12.1 › create-ecdh@4.0.4 › elliptic@6.5.4

Overview
elliptic is a fast elliptic-curve cryptography implementation in plain javascript.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to a missing signature length check in the EDDSA signature process. An attacker can manipulate the signature by appending or removing zero-valued bytes.
Remediation
Upgrade elliptic to version 6.6.1 or higher.