GHSA-8qxj-f9rh-9fg2CriticalCVSS 9.1

Improper Verification of Cryptographic Signature in Pure-Python ECDSA

Published
April 1, 2020
Last Modified
September 20, 2024

🔗 CVE IDs covered (1)

📋 Description

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.

🎯 Affected products1

  • pip/ecdsa:< 0.13.3

🔗 References (11)