CVE-2021-43570: Improper Verification of Cryptographic Signature in starkbank-ecdsa
Summary
CVE-2021-43570: Improper Verification of Cryptographic Signature in starkbank-ecdsa. Affects com.starkbank.ellipticcurve:starkbank-ecdsa versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The starkbank-ecdsa package is a Java library that provides functionality for ECDSA (Elliptic Curve Digital Signature Algorithm) in the Stark Bank ecosystem. It allows users to generate and verify cryptographic signatures for secure communication and data integrity. However, a vulnerability has been discovered in version 1.0.0 of the library, which fails to properly verify the cryptographic signature, enabling attackers to forge signatures on arbitrary messages.
Vulnerability Detail
The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 does not check that the signature is non-zero. This oversight allows malicious actors to create valid signatures for any message, bypassing the intended security measures. As a result, the integrity and authenticity of the signed data can no longer be guaranteed. This vulnerability poses a significant risk as it undermines the trust and reliability of the cryptographic signature mechanism.
How To Fix
Minimum fixed version
1.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version (1.0.1) of the starkbank-ecdsa library to mitigate the risk of signature forgery.
Conclusion
The vulnerability in the starkbank-ecdsa library (ecdsa-java) version 1.0.0 allows attackers to forge signatures on arbitrary messages due to improper verification of the cryptographic signature. To mitigate this risk, users should update to version 1.0.1 of the library. It is crucial to prioritize the security of your application by promptly applying the necessary updates and keeping all dependencies up to date. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.starkbank.ellipticcurve:starkbank-ecdsa →
FAQ
This vulnerability allows attackers to forge signatures on arbitrary messages, compromising the integrity and authenticity of the signed data. It undermines the trust in the cryptographic signature mechanism and can lead to unauthorized access, data tampering, and other security breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are detected.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is crucial to update to the fixed version (1.0.1) of the starkbank-ecdsa library to mitigate the risk.
This vulnerability specifically affects the starkbank-ecdsa library version 1.0.0. However, it is always recommended to keep all dependencies up to date to ensure the overall security of your application.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-r28h-x6hv-2fq3/GHSA-r28h-x6hv-2fq3.json
