PYSEC-2020-42

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/fastecdsa/PYSEC-2020-42.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/PYSEC-2020-42
Aliases
Published
2020-06-02T21:15:00Z
Modified
2023-11-01T04:51:36.966243Z
Summary
[none]
Details

An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.

References

Affected packages

PyPI / fastecdsa

Package

Name
fastecdsa
View open source insights on deps.dev
Purl
pkg:pypi/fastecdsa

Affected ranges

Type
GIT
Repo
https://github.com/AntonKueltz/fastecdsa
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4a16daeaf139be20654ef58a9fe4c79dc030458c
Fixed
7b64e3efaa806b4daaf73bb5172af3581812f8de
Fixed
e592f106edd5acf6dacedfab2ad16fe6c735c9d1
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.1.2

Affected versions

1.*

1.0.0b1
1.0.1b1
1.0.1b2
1.0.1b3
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.2.1
1.3.1
1.3.2
1.4.1
1.4.2
1.4.3
1.5.1
1.5.2
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5

2.*

2.0.0
2.1.0
2.1.1