Denial of Service Vulnerability in python-ecdsa: Malformed DER Signature Handling
Summary
CVE-2019-14853: An error-handling flaw was found in python-ecdsa before version 0.13.3. Affects python-ecdsa versions < 0.13.3-1. Fixed in 0.13.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-ecdsa is a Python library that implements the Elliptic Curve Digital Signature Algorithm (ECDSA). It is widely used for secure communications and cryptographic operations. The library allows developers to create and verify digital signatures, ensuring data integrity and authenticity. However, prior to version 0.13.3, it contained an error-handling flaw that could lead to unexpected behavior when processing malformed DER signatures.
Vulnerability Detail
An error-handling flaw was identified in python-ecdsa before version 0.13.3. During the decoding of digital signatures, the library could raise unexpected exceptions or fail to raise exceptions altogether when encountering malformed DER signatures. This behavior could be exploited to cause a denial of service (DoS), as the application using the library may become unresponsive or crash. The vulnerability is particularly concerning for applications that rely on robust signature verification, as it undermines the reliability of the cryptographic operations.
How To Fix
Minimum fixed version
0.13.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-ecdsaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation to check the integrity of the DER signatures before processing them. This can help mitigate the risk of malformed signatures causing issues in your application.
Conclusion
The python-ecdsa library has a significant vulnerability that can lead to denial of service when handling malformed DER signatures. It is crucial for developers using this library to update to version 0.13.3 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for python-ecdsa →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions of python-ecdsa prior to 0.13.3 are affected by this vulnerability.
The vulnerability can lead to denial of service, causing applications to become unresponsive or crash when processing malformed signatures.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing your manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python-ecdsa.
