PT-2021-23875 · Stark Bank · Stark Bank Java Ecdsa Library

Published 2021-11-09 · Updated 2021-11-12 · CVE-2021-43570

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stark Bank Java ECDSA library (ecdsa-java) version 1.0.0

Description The verify function in the Stark Bank Java ECDSA library fails to check that the signature is non-zero, allowing attackers to forge signatures on arbitrary messages.

Recommendations For version 1.0.0, consider disabling the verify function until a patch is available to prevent attackers from forging signatures. Restrict the use of the library for critical operations that rely on the authenticity of messages.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2021-43570

GHSA-R28H-X6HV-2FQ3

Affected Products

Stark Bank Java Ecdsa Library

References · 9

• 🔥 https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries · Exploit
• https://osv.dev/vulnerability/GHSA-r28h-x6hv-2fq3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43570 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43570 · Vendor Advisory
• https://github.com/starkbank/ecdsa-java/pull/16 · Note
• https://github.com/starkbank/ecdsa-java · Note
• https://github.com/starkbank/ecdsa-java/commit/ed22e484186d6c66d3686bfe39d01bdbabf219b6 · Note
• https://github.com/starkbank/ecdsa-java/releases/tag/v1.0.1 · Note
• https://t.me/cibsecurity/32122 · Telegram Post