Fluid Attacks Database

Description

An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	python-ecdsa	>=0 <0.13.3-1	0.13.3-1
debian 13	python-ecdsa	>=0 <0.13.3-1	0.13.3-1
pypi	ecdsa	>=0 <0.13.3	0.13.3
debian 14	python-ecdsa	>=0 <0.13.3-1	0.13.3-1
debian 11	python-ecdsa	>=0 <0.13.3-1	0.13.3-1

Aliases

1. CVE-2019-148532. NVD-2019-148533. OSV-DEBIAN-2019-148534. OSV-2019-148535. GHSA-pwfw-mgfj-7g3g6. GCVE-2019-148537. SECURITY-TRACKER-CVE-2019-14853

References

1. https://github.com/warner/python-ecdsa/security/advisories/GHSA-pwfw-mgfj-7g3g2. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-148533. https://github.com/pypa/advisory-database/tree/main/vulns/ecdsa/PYSEC-2019-177.yaml4. https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.35. https://seclists.org/bugtraq/2019/Dec/336. https://www.debian.org/security/2019/dsa-4588

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.