Skip to content
OpenAdvisories
Critical USN-6239-1 1 CVE

ecdsautils vulnerability

Published Jul 20, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that ECDSA Util did not properly verify certain
signature values.
An attacker could possibly use this issue to bypass signature
verification.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS ecdsautils 0.3.2+git20151018-2+deb10u1build0.20.04.1
Ubuntu · 22.04 LTS 22.04:LTS ecdsautils 0.3.2+git20151018-2+deb10u1build0.22.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ecdsautils 0.3.2+git20151018-2ubuntu0.16.04.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ecdsautils 0.3.2+git20151018-2ubuntu0.18.04.1~esm1

Vulnerabilities 1

  • Critical 10.0
    CVE-2022-24884

    Trivial signature forgery in ecdsautils

    ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature values `r` and `s` are non-zero. A signature consisting only of zeroes is always considered valid, making…

    freifunk-gluon ecdsautils ecdsautils ecdsautils Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2022-24884