CVE-2021-43569: Improper Verification of Cryptographic Signature in starkbank-ecdsa
Summary
CVE-2021-43569: Improper Verification of Cryptographic Signature in starkbank-ecdsa. Affects starkbank-ecdsa versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The starkbank-ecdsa package is a NuGet package that provides ECDSA (Elliptic Curve Digital Signature Algorithm) functionality for .NET applications. It allows users to generate and verify cryptographic signatures using ECDSA. The package is widely used in various applications that require secure digital signatures. However, a vulnerability has been identified in version 1.3.1 of the package, which allows attackers to forge signatures on arbitrary messages.
Vulnerability Detail
The verify function in the starkbank-ecdsa library fails to properly verify the cryptographic signature. Specifically, it does not check that the signature is non-zero, which means that an attacker can create a valid signature for any message without possessing the private key. This vulnerability can have severe consequences as it undermines the integrity and authenticity of digital signatures. Attackers can potentially impersonate legitimate users, tamper with signed data, or perform other malicious activities that rely on the trustworthiness of digital signatures.
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the starkbank-ecdsa package as soon as possible.
Conclusion
In conclusion, the starkbank-ecdsa package version 1.3.1 is vulnerable to an improper verification of cryptographic signature vulnerability. This vulnerability allows attackers to forge signatures on arbitrary messages, compromising the integrity and authenticity of digital signatures. Users should upgrade to version 1.3.2 or later of the package to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for starkbank-ecdsa →
FAQ
This vulnerability allows attackers to forge signatures on arbitrary messages, compromising the integrity and authenticity of digital signatures. It can lead to impersonation of legitimate users, tampering with signed data, and other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your packages.config file, and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
There are no known exploits for this vulnerability at the time of this report. However, it is crucial to address the vulnerability promptly to prevent potential attacks.
No, upgrading to the latest version of the starkbank-ecdsa package is the recommended solution to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for starkbank-ecdsa.
