CVE-2019-14853
published 2019-11-26CVE-2019-14853: An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions…
PriorityP335high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.50%
83.0th percentile
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-ecdsa | < python-ecdsa 0.13.3-1 (bookworm) | python-ecdsa 0.13.3-1 (bookworm) |
| python-ecdsa_project | python-ecdsa | < 0.13.3 | 0.13.3 |
| python-ecdsa_project | python-ecdsa | >= 0 < 0.13.3-1 | 0.13.3-1 |
| python-ecdsa_project | python-ecdsa | >= 0 < 0.13.3-1 | 0.13.3-1 |
| python-ecdsa_project | python-ecdsa | >= 0 < 0.13.3-1 | 0.13.3-1 |
| python-ecdsa_project | python-ecdsa | >= 0 < 0.13.3-1 | 0.13.3-1 |
| python-ecdsa_project | python-ecdsa | >= 0 < 0.13-2ubuntu0.16.04.1 | 0.13-2ubuntu0.16.04.1 |
| python-ecdsa_project | python-ecdsa | >= 0 < 0.13-2ubuntu0.18.04.1 | 0.13-2ubuntu0.18.04.1 |
| tlsfuzzer | ecdsa | >= 0 < 0.13.3 | 0.13.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.03.7LOWCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Duplicate Advisory: possible DoS caused by malformed signature decoding in Pure-Python ECDSA
osv·2019-12-02
CVE-2019-14853 [MEDIUM] Duplicate Advisory: possible DoS caused by malformed signature decoding in Pure-Python ECDSA
Duplicate Advisory: possible DoS caused by malformed signature decoding in Pure-Python ECDSA
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-pwfw-mgfj-7g3g. This link is maintained to preserve external references.
OSV
CVE-2019-14853: An error-handling flaw was found in python-ecdsa before version 0
osv·2019-11-26·CVSS 7.5
CVE-2019-14853 [HIGH] CVE-2019-14853: An error-handling flaw was found in python-ecdsa before version 0
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
OSV
python-ecdsa vulnerabilities
osv·2019-11-18·CVSS 7.5
CVE-2019-14853 [HIGH] python-ecdsa vulnerabilities
python-ecdsa vulnerabilities
It was discovered that python-ecdsa incorrectly handled certain signatures.
A remote attacker could possibly use this issue to cause python-ecdsa to
generate unexpected exceptions, resulting in a denial of service.
(CVE-2019-14853)
It was discovered that python-ecdsa incorrectly verified DER encoding in
signatures. A remote attacker could use this issue to perform certain
malleability attacks. (CVE-2019-14859)
GHSA
ecdsa Denial of Service vulnerability in signature verification and signature malleability
ghsa·2019-10-08
CVE-2019-14853 [HIGH] CWE-391 ecdsa Denial of Service vulnerability in signature verification and signature malleability
ecdsa Denial of Service vulnerability in signature verification and signature malleability
## possible DoS in signature verification and signature malleability
### Impact
Code using `VerifyingKey.verify()` and `VerifyingKey.verify_digest()` may receive exceptions other than the documented `BadSignatureError` when signatures are malformed. If those other exceptions are not caught, they may lead to program termination and thus Denial of Service
Code using `VerifyingKey.verify()` and `VerifyingKey.verify_digest()` with `sigdecode` option using `ecdsa.util.sigdecode_der` will accept signatures even if they are not properly formatted DER. This makes the signatures malleable. It impacts only applications that later sign the signatures or verify signatures of signatures, e.g. Bitcoin.
All ver
OSV
ecdsa Denial of Service vulnerability in signature verification and signature malleability
osv·2019-10-08
CVE-2019-14853 [HIGH] ecdsa Denial of Service vulnerability in signature verification and signature malleability
ecdsa Denial of Service vulnerability in signature verification and signature malleability
## possible DoS in signature verification and signature malleability
### Impact
Code using `VerifyingKey.verify()` and `VerifyingKey.verify_digest()` may receive exceptions other than the documented `BadSignatureError` when signatures are malformed. If those other exceptions are not caught, they may lead to program termination and thus Denial of Service
Code using `VerifyingKey.verify()` and `VerifyingKey.verify_digest()` with `sigdecode` option using `ecdsa.util.sigdecode_der` will accept signatures even if they are not properly formatted DER. This makes the signatures malleable. It impacts only applications that later sign the signatures or verify signatures of signatures, e.g. Bitcoin.
All ver
Ubuntu
python-ecdsa vulnerabilities
vendor_ubuntu·2019-11-18·CVSS 7.5
CVE-2019-14853 [HIGH] python-ecdsa vulnerabilities
Title: python-ecdsa vulnerabilities
Summary: Several security issues were fixed in python-ecdsa.
It was discovered that python-ecdsa incorrectly handled certain signatures.
A remote attacker could possibly use this issue to cause python-ecdsa to
generate unexpected exceptions, resulting in a denial of service.
(CVE-2019-14853)
It was discovered that python-ecdsa incorrectly verified DER encoding in
signatures. A remote attacker could use this issue to perform certain
malleability attacks. (CVE-2019-14859)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-ecdsa: Unexpected and undocumented exceptions during signature decoding
vendor_redhat·2019-09-26·CVSS 7.5
CVE-2019-14853 [HIGH] CWE-391 python-ecdsa: Unexpected and undocumented exceptions during signature decoding
python-ecdsa: Unexpected and undocumented exceptions during signature decoding
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
An error-handling flaw was found in python-ecdsa. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
Statement: Although Red Hat OpenStack Platform ships the flawed code, RHOSP does not actually use python-ecdsa's functionality. As such, Red Hat OpenStack Platform will not be providing a fix for python-ecdsa at this time.
Current releases of Red Hat Virtualization Manager no longer incl
Debian
CVE-2019-14853: python-ecdsa - An error-handling flaw was found in python-ecdsa before version 0.13.3. During s...
vendor_debian·2019·CVSS 7.5
CVE-2019-14853 [HIGH] CVE-2019-14853: python-ecdsa - An error-handling flaw was found in python-ecdsa before version 0.13.3. During s...
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
Scope: local
bookworm: resolved (fixed in 0.13.3-1)
bullseye: resolved (fixed in 0.13.3-1)
forky: resolved (fixed in 0.13.3-1)
sid: resolved (fixed in 0.13.3-1)
trixie: resolved (fixed in 0.13.3-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-14853 python-ecdsa: Unexpected and undocumented exceptions during signature decoding [epel-all]
bugzilla·2019-10-04·CVSS 7.5
CVE-2019-14853 [HIGH] CVE-2019-14853 python-ecdsa: Unexpected and undocumented exceptions during signature decoding [epel-all]
CVE-2019-14853 python-ecdsa: Unexpected and undocumented exceptions during signature decoding [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mu
Bugzilla
CVE-2019-14853 python-ecdsa: Unexpected and undocumented exceptions during signature decoding
bugzilla·2019-10-04·CVSS 7.5
CVE-2019-14853 [HIGH] CVE-2019-14853 python-ecdsa: Unexpected and undocumented exceptions during signature decoding
CVE-2019-14853 python-ecdsa: Unexpected and undocumented exceptions during signature decoding
A flaw was found in python-ecdsa. Unexpected and undocumented exceptions can be raised during signature decoding may lead to denial of service in some cases. All the versions between at least 0.5 and 0.13.2 are thought to be vulnerable.
Upstream issue:
https://github.com/warner/python-ecdsa/issues/114
Upstream patch:
https://github.com/warner/python-ecdsa/pull/115
References:
https://github.com/warner/python-ecdsa/blob/bb359d32e93acc3eb4d216aff4ba0e7531599cfb/ecdsa/keys.py#L98-L113
Discussion:
Created python-ecdsa tracking bugs for this issue:
Affects: epel-all [bug 1758706]
Affects: fedora-all [bug 1758705]
---
Version 0.13.3 of the library, that addresses this issue has been released
Bugzilla
CVE-2019-14853 python-ecdsa: Unexpected and undocumented exceptions during signature decoding [fedora-all]
bugzilla·2019-10-04·CVSS 7.5
CVE-2019-14853 [HIGH] CVE-2019-14853 python-ecdsa: Unexpected and undocumented exceptions during signature decoding [fedora-all]
CVE-2019-14853 python-ecdsa: Unexpected and undocumented exceptions during signature decoding [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affect
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14853https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3https://seclists.org/bugtraq/2019/Dec/33https://www.debian.org/security/2019/dsa-4588https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14853https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3https://seclists.org/bugtraq/2019/Dec/33https://www.debian.org/security/2019/dsa-4588
2019-11-26
Published