PT-2026-28568 · Pypi · Ecdsa

0Xmrma · Publicado 2026-03-27 · Atualizado 2026-06-03 · CVE-2026-33936

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions ecdsa versions prior to 0.19.2

Description The ecdsa package, a Python implementation of ECC, contains a flaw in its DER parsing functions. Specifically, ecdsa.der.remove octet string() incorrectly accepts truncated DER data where the declared length exceeds the actual buffer size. This can lead to SigningKey.from der() raising an internal IndexError instead of a clean rejection of malformed DER, potentially causing a denial of service when parsing untrusted DER private keys. A crafted DER input can trigger this issue.

Recommendations Upgrade to ecdsa version 0.19.2 or later.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-130

CWE-20

Identificadores relacionados

CVE-2026-33936

ECHO-DC11-DAA6-FC93

GHSA-9F5J-8JWJ-X28G

OESA-2026-1836

OESA-2026-1837

OESA-2026-1838

OESA-2026-1839

OPENSUSE-SU-2026:10468-1

SUSE-SU-2026:1436-1

SUSE-SU-2026:1608-1

Produtos afetados

Ecdsa

Referências · 32

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33936.json · Exploit
• https://github.com/tlsfuzzer/python-ecdsa/commit/bd66899550d7185939bf27b75713a2ac9325a9d3 · Correção
• https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-9f5j-8jwj-x28g · Aviso do Fabricante
• https://github.com/tlsfuzzer/python-ecdsa/releases/tag/python-ecdsa-0.19.2 · Nota
• https://github.com/tlsfuzzer/python-ecdsa · Nota
• https://ubuntu.com/security/CVE-2026-33936 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2026:10468-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-33936 · Nota de Segurança
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1839 · Nota
• https://suse.com/support/update/announcement/2026/suse-su-20261436-1 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2026:1608-1 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037719346789970118 · Publicação no Twitter
• https://osv.dev/vulnerability/OESA-2026-1838 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2026/suse-su-20261608-1 · Nota
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-33936 · Aviso do Fabricante