Malleable Signature Vulnerability in python-ecdsa: CVE-2019-14859
Summary
CVE-2019-14859: A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Affects python-ecdsa versions < 0.13.3-1. Fixed in 0.13.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-ecdsa is a Python library that provides Elliptic Curve Digital Signature Algorithm (ECDSA) functionality. It is widely used for secure transactions and cryptographic operations. The library's primary function is to generate and verify digital signatures, ensuring the integrity and authenticity of messages. However, prior to version 0.13.3, the library had a critical vulnerability that allowed for the acceptance of malformed signatures due to improper verification of DER encoding.
Vulnerability Detail
The vulnerability identified as CVE-2019-14859 arises from a flaw in all versions of python-ecdsa prior to 0.13.3. The library failed to correctly verify whether signatures were using DER encoding. This oversight allowed an attacker to exploit the system by crafting a malformed signature that could be accepted as valid, leading to malleable signatures. Such signatures could be manipulated to create false transactions, posing significant risks to the integrity of systems relying on this library for secure communications.
How To Fix
Minimum fixed version
0.13.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-ecdsaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing additional validation checks for signatures to ensure they conform to expected formats. However, this is not a substitute for upgrading the library.
Conclusion
CVE-2019-14859 is a significant vulnerability in the python-ecdsa library that can lead to serious security risks if not addressed. Users are strongly encouraged to upgrade to version 0.13.3 or later to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for python-ecdsa →
FAQ
CVE-2019-14859 is a vulnerability in the python-ecdsa library that allows for the acceptance of malformed signatures due to improper verification of DER encoding.
The primary risk is that an attacker could create false transactions by exploiting malleable signatures, undermining the integrity of systems that rely on the library for secure transactions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2019-14859 is 9.1, indicating a high severity level.
You can upgrade python-ecdsa by running 'pip install --upgrade python-ecdsa' in your terminal or by using your package manager for Debian-based systems.
Related vulnerabilities
Recent vulnerabilities recorded for python-ecdsa.
