Description
The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tlsfuzzer | python-ecdsa | <= 0.18.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-ecdsa | No fix yet | — |
| Debian 13 | python-ecdsa | No fix yet | — |
| Debian 12 | python-ecdsa | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-ecdsa | No fix yet | — |
| Ubuntu 26.04 LTS | python-ecdsa | No fix yet | — |
| Ubuntu 25.10 | python-ecdsa | No fix yet | — |
| Ubuntu 24.04 LTS | python-ecdsa | No fix yet | — |
| Ubuntu 22.04 LTS | python-ecdsa | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | python-ecdsa | No fix yet | — |
| Ubuntu 18.04 LTS | python-ecdsa | No fix yet | — |
| Ubuntu 16.04 LTS | python-ecdsa | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | python-pulp-container +1 | 2.16.9-2.el8pc | RHSA-2024:10806 |
| Red Hat Satellite Capsule 6 | rubygem-rack | 2.2.8.1-1.el8sat | RHSA-2024:10806 |
| Red Hat Satellite 6 | python-pulp-container +1 | 2.16.9-2.el8pc | RHSA-2024:10806 |
| Red Hat Satellite 6 | rubygem-activestorage | 6.1.7.7-1.el8sat | RHSA-2024:10806 |
| Red Hat Satellite 6 | rubygem-rack | 2.2.8.1-1.el8sat | RHSA-2024:10806 |
| Red Hat Rhui 4 | python-aiohttp +1 | 3.9.2-1.el8ui | RHSA-2024:1878 |
| Red Hat Rhui 4 | python-cryptography +1 | 41.0.6-1.el8ui | RHSA-2024:1878 |
| Red Hat Rhui 4 | python-django +1 | 4.2.11-1.el8ui | RHSA-2024:1878 |
| Red Hat Rhui 4 | python-ecdsa +1 | 0.18.0-4.el8ui | RHSA-2024:1878 |
| Red Hat Rhui 4 | python-jinja2 +1 | 3.1.3-1.el8ui | RHSA-2024:1878 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.2.2-r0 | — |
| Wolfi rolling | checkov +1 | No fix yet | — |
| Wolfi rolling | open-webui | 0.11.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ecdsa | all versions | — | GHSA-wj6h-64fc-37mp |
Advisories 2
- RHSA-2024:10806 Red Hat Security Advisory: Satellite 6.15.5 Async Update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- RHSA-2024:1878 Red Hat Security Advisory: RHUI 4.8 Release - Security Updates, Bug Fixes, and Enhancements Red Hat Security Advisories (RHSA) · Sep 9, 2026