logo

Database

User enumeration In python-ecdsa

Description

The ecdsa PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version

Aliases

1. CVE-2024-233422. NVD-2024-233423. OSV-DEBIAN-2024-233424. OSV-2024-233425. GHSA-wj6h-64fc-37mp6. GCVE-2024-233427. SECURITY-TRACKER-CVE-2024-23342

References

1. https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp2. https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md3. https://minerva.crocs.fi.muni.cz4. https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.