Home

CVE-2019-14859

Description

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.

Risk Information

Base Score
9.1
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score
Exploitation Probability
0.065

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2019-14853,CVE-2019-14859 are fixed in Python-ecdsa 0.13.3Windows
ECDSA cryptographic signature library (USN-4196-1) python-ecdsa_0.13-3ubuntu0.1_all.debLinux
ECDSA cryptographic signature library (USN-4196-1) python-ecdsa_0.13.2-2ubuntu0.1_all.debLinux
ECDSA cryptographic signature library (USN-4196-1) python-ecdsa_0.13-2ubuntu0.16.04.1_all.debLinux
ECDSA cryptographic signature library (USN-4196-1) python-ecdsa_0.13-2ubuntu0.18.04.1_all.debLinux
ECDSA cryptographic signature library (USN-4196-1) python3-ecdsa_0.13-3ubuntu0.1_all.debLinux
ECDSA cryptographic signature library (USN-4196-1) python3-ecdsa_0.13.2-2ubuntu0.1_all.debLinux
ECDSA cryptographic signature library (USN-4196-1) python3-ecdsa_0.13-2ubuntu0.16.04.1_all.debLinux
ECDSA cryptographic signature library (USN-4196-1) python3-ecdsa_0.13-2ubuntu0.18.04.1_all.debLinux
python-ecdsa security update(DSA-4588-1) python-ecdsa_0.13-2+deb9u1_all.debLinux
python-ecdsa security update(DSA-4588-1) python-ecdsa_0.13-3+deb10u1_all.debLinux
Vulnerabilities CVE-2019-14853,CVE-2019-14859 are fixed in Python-ecdsa for linux 0.13.3Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234