PYSEC-2021-426

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/starkbank-ecdsa/PYSEC-2021-426.yaml

JSON Data

https://api.test.osv.dev/v1/vulns/PYSEC-2021-426

Aliases

Published

2021-11-09T22:15:00Z

Modified

2023-11-01T04:56:43.158908Z

Summary

[none]

Details

The verify function in the Stark Bank Python ECDSA library (ecdsa-python) 2.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

References

Affected packages

PyPI / starkbank-ecdsa

Package

Name: starkbank-ecdsa; View open source insights on deps.dev
Purl: pkg:pypi/starkbank-ecdsa

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.1

Affected versions

0.*

0.1

0.1.1

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.1.7

0.1.8

0.1.9

1.*

1.0.0

1.1.0

1.1.1

2.*

2.0.0

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/starkbank-ecdsa/PYSEC-2021-426.yaml"