Upgrade elliptic version to >=6.5.4 about oracle-contracts HOT 4 CLOSED

Remediation

Upgrade elliptic to version 6.5.4 or later. For example:

"dependencies": {
  "elliptic": ">=6.5.4"
}

or…

"devDependencies": {
  "elliptic": ">=6.5.4"
}

Always verify the validity and compatibility of suggestions with your codebase.

Details

CVE-2020-28498
moderate severity
Vulnerable versions: < 6.5.4
Patched version: 6.5.4
The npm package elliptic before version 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.

from oracle-contracts.

Seems a small issue pending for a long time. @dev1644 can you resolve this?

from oracle-contracts.

@hrishikeshio, I & @SkandaBhat already discussed it a few months back, I forgot to update the issue. Here's the conclusion from the investigation.

That security vulnerability is coming from dependencies, Caused by these dependencies -

• solidity-coverage
• hardhat-gas-reporter
• eth-gas-reporter (same as hardhat-gas-reporter) I have removed it.
• @nomiclabs/hardhat-truffle5

solidity-coverage generates coverage report so not an issue, same with hardhat-gas-reporter.
hardhat-truffle5 is a plugin that we use to execute our tests so no harm here too.

I think it's not worth the effort since the issue is not severe and only is in dev tools.

from oracle-contracts.

Closing this issue. We have to wait till one of the dependencies is upgraded. Then, dependabot will automatically bump up the version.

from oracle-contracts.