CVE-2019-14853: Vulnerability in python-ecdsa
Summary
CVE-2019-14853: An error-handling flaw was found in python-ecdsa before version 0.13.3. Affects ecdsa versions < 0.13.3. Fixed in 0.13.3. How to fix ↓
Also tracked for
- python-ecdsa · Debian:11
The same CVE-2019-14853 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python-ecdsa is a Python implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA). It provides functionality for generating and verifying ECDSA signatures. This vulnerability affects versions prior to 0.13.3. The package is commonly used in Python applications that require cryptographic operations using elliptic curve cryptography.
Vulnerability Detail
The vulnerability (CVE-2019-14853) is an error-handling flaw in python-ecdsa. It occurs during signature decoding, where malformed DER signatures can raise unexpected exceptions or no exceptions at all. This flaw can be exploited to cause a denial of service. An attacker could craft a specially crafted DER signature that triggers the error-handling flaw, leading to the application crashing or becoming unresponsive.
How To Fix
Latest published version: 0.19.2 as of 23 Oct 2026
pip install --upgrade "ecdsa==0.19.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.13.3
This is the first release that contains the fix.
pip install --upgrade "ecdsa==0.13.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of python-ecdsa to mitigate the risk.
Conclusion
In conclusion, the vulnerability (CVE-2019-14853) in python-ecdsa can be exploited to cause a denial of service. It is crucial to upgrade to version 0.13.3 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ecdsa →
FAQ
Python-ecdsa is a Python library that provides functionality for generating and verifying ECDSA signatures.
The vulnerability can lead to a denial of service, causing the application to crash or become unresponsive.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. No signup is required, and you can analyze your Pipfile.lock to identify any vulnerable dependencies.
There are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of python-ecdsa.
You can find more information about this vulnerability in the official advisory database for python-ecdsa at https://github.com/pypa/advisory-database/blob/main/vulns/ecdsa/PYSEC-2019-177.yaml
Related vulnerabilities
Recent vulnerabilities recorded for ecdsa.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
