Summary
It was discovered that python-ecdsa incorrectly handled certain signatures.
A remote attacker could possibly use this issue to cause python-ecdsa to
generate unexpected exceptions, resulting in a denial of service.
(CVE-2019-14853)
It was discovered that python-ecdsa incorrectly verified DER encoding in
signatures. A remote attacker could use this issue to perform certain
malleability attacks. (CVE-2019-14859)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | python-ecdsa | 0.13-2ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | python-ecdsa | 0.13-2ubuntu0.18.04.1 |
Vulnerabilities 2
-
High 7.4
Improper Verification of Cryptographic Signature in Pure-Python ECDSA
A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verificatio…
-
Low 3.7
ecdsa Denial of Service vulnerability in signature verification and signature malleability
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.