CVE-2019-14859: Improper Verification of Cryptographic Signature in Pure-Python ECDSA

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The 'ecdsa' package is a Python library that provides an implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA). It is commonly used for cryptographic operations, such as generating and verifying digital signatures. The vulnerability identified as CVE-2019-14859 affects all versions of python-ecdsa prior to 0.13.3. This vulnerability arises from the package's failure to correctly verify whether signatures used DER encoding. As a result, a malformed signature could be accepted, allowing for signature malleability. This vulnerability could be exploited by an attacker to create false transactions.

Vulnerability Detail

The vulnerability in python-ecdsa versions prior to 0.13.3 lies in the improper verification of cryptographic signatures using DER encoding. The package fails to adequately validate the signature format, allowing for the acceptance of malformed signatures. This oversight enables an attacker to manipulate the signature, potentially leading to the creation of false transactions. The vulnerability has a CVSS score of 9.1, indicating its critical severity.

pip install --upgrade "ecdsa==0.19.2"

pip install --upgrade "ecdsa==0.13.3"

Workaround

As a workaround, users can manually validate the signature format before processing it. This can be achieved by implementing custom checks to ensure that the signature adheres to the expected DER encoding format. Here is an example of a Python function that performs this validation:

def validate_signature(signature):
    # Implement custom validation logic here
    if not is_der_encoded(signature):
        raise ValueError('Invalid signature format')

# Usage:
signature = get_signature()
validate_signature(signature)

Conclusion

In conclusion, the CVE-2019-14859 vulnerability in python-ecdsa versions prior to 0.13.3 allows for the acceptance of malformed signatures, leading to signature malleability. This can be exploited by attackers to create false transactions. It is crucial to upgrade to the fixed version or implement the recommended workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for ecdsa →

FAQ