PT-2021-24411 · Unknown · Stark Bank

Published 2021-11-08 · Updated 2021-11-08

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: Stark Bank (affected versions not specified)

Description: An attacker can forge signatures on arbitrary messages that will verify for any public key. This may allow attackers to authenticate as any user within the Stark Bank platform, and bypass signature verification needed to perform operations on the platform, such as send payments and transfer funds. Additionally, the ability for attackers to forge signatures may impact other users and projects using these libraries in different and unforeseen ways.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

GHSA-9WX7-JRVC-28MM

Affected Products

Stark Bank

References · 9

• https://osv.dev/vulnerability/GHSA-9wx7-jrvc-28mm · Vendor Advisory
• https://github.com/starkbank/ecdsa-python/releases/tag/v2.0.1 · Note
• https://github.com/starkbank/ecdsa-python/commit/d136170666e9510eb63c2572551805807bd4c17f · Note
• https://github.com/starkbank/ecdsa-python/compare/v2.0.0...v2.0.1 · Note
• https://github.com/starkbank/ecdsa-python · Note
• https://github.com/starkbank/ecdsa-dotnet · Note
• https://github.com/starkbank/ecdsa-node · Note
• https://github.com/starkbank/ecdsa-java · Note
• https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries · Note