PYSEC-2020-163

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/ecdsa/PYSEC-2020-163.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2020-163
Aliases
Published
2020-01-02T15:15:00Z
Modified
2023-11-01T05:44:38.481791Z
Summary
[none]
Details

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.

References

Affected packages

PyPI / ecdsa

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.13.3

Affected versions

0.*

0.6
0.7
0.8
0.9
0.10
0.11
0.12
0.13
0.13.1
0.13.2