The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k'     (as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading     zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This happens, because     the byte-length of 'k' is incorrectly computed, resulting in its getting truncated during the computation.
    Legitimate transactions or communications will be broken as a result. Furthermore, due to the nature of     the fault, attackers couldunder certain conditionsderive the secret key, if they could get their hands     on both a faulty signature generated by a vulnerable version of Elliptic and a correct signature for the     same inputs. This issue affects all known versions of Elliptic (at the time of writing, versions less than     or equal to 6.6.1). (CVE-2025-14505)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-14505

medium Nessus Plugin ID 282580

Version 1.3