CVE-2019-14859
Severity
9.1CRITICAL
EPSS
0.1%
top 79.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 2
Latest updateApr 1
Description
A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2
Affected Packages8 packages
Patches
🔴Vulnerability Details
5📋Vendor Advisories
3💬Community
3Bugzilla
▶
Bugzilla▶
CVE-2019-14859 python-ecdsa: DER encoding is not being veryfied in signatures [fedora-all]↗2019-10-11