PT-2021-23877 · Stark Bank · Stark Bank Python Ecdsa Library

Published 2021-11-09 · Updated 2022-03-24 · CVE-2021-43572

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stark Bank Python ECDSA library versions 2.0.0 through 2.0.0

Description The verify function in the Stark Bank Python ECDSA library fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages. This issue affects the verify function, allowing attackers to forge signatures on arbitrary messages by exploiting the lack of a non-zero signature check.

Recommendations For Stark Bank Python ECDSA library version 2.0.0, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider adding a check to ensure the signature is non-zero before verifying it with the verify function until a patch is available.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2021-43572

GHSA-92VM-MXJF-JQF3

PYSEC-2021-426

Affected Products

Stark Bank Python Ecdsa Library

References · 13

• 🔥 https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries · Exploit
• https://github.com/starkbank/ecdsa-python/commit/d136170666e9510eb63c2572551805807bd4c17f · Patch
• https://osv.dev/vulnerability/GHSA-92vm-mxjf-jqf3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43572 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-426 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43572 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/starkbank-ecdsa/PYSEC-2021-426.yaml · Note
• https://github.com/starkbank/ecdsa-python/releases/tag/v2.0.1 · Note
• https://github.com/starkbank/ecdsa-python · Note
• https://t.me/cvenotify/26914 · Telegram Post
• https://t.me/cibsecurity/32123 · Telegram Post
• https://github.com/advisories/GHSA-92vm-mxjf-jqf3 · Note
• https://t.me/cvenotify/27098 · Telegram Post