Input validation error in python-ecdsa - CVE-2019-14859

Vulnerability identifier: #VU22620

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-14859

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to signature malleability while processing DER-encoded data. A remote attacker can bypass certain security restrictions.

python-ecdsa
Amazon Linux AMI
Fedora
Opensuse
python-ecdsa (Debian package)
py3-ecdsa (Alpine package)
python-ecdsa

Install updates from vendor's website.

python-ecdsa - update to 0.13.3
python-ecdsa (Debian package) - addressed in versions 0.13-2+deb9u1, 0.13-3+deb10u1
python-ecdsa - update to 0.11-3.4
python-ecdsa - update to 0.13.3-1.el7

• https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3

• Multiple vulnerabilities in Pure-Python ECDSA Python package
• OpenSUSE Linux update for python-ecdsa
• OpenSUSE Linux update for python-ecdsa
• Debian update for python-ecdsa
• Input validation error in py3-ecdsa (Alpine package)
• Amazon Linux AMI update for python-ecdsa
• Fedora EPEL 7 update for python-ecdsa