CVE-2021-43572

Опубликовано: 09 нояб. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

Ссылки

https://github.com/starkbank/ecdsa-python/commit/d136170666e9510eb63c2572551805807bd4c17f
Patch
Third Party Advisory
https://github.com/starkbank/ecdsa-python/releases/tag/v2.0.1
Release Notes
Third Party Advisory
https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/
Exploit
Third Party Advisory
https://github.com/starkbank/ecdsa-python/commit/d136170666e9510eb63c2572551805807bd4c17f
Patch
Third Party Advisory
https://github.com/starkbank/ecdsa-python/releases/tag/v2.0.1
Release Notes
Third Party Advisory
https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:starkbank:ecdsa-python:*:*:*:*:*:*:*:*

Версия до 2.0.1 (исключая)

EPSS

Процентиль: 47%

0.00241

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-347

Связанные уязвимости

GHSA-92vm-mxjf-jqf3