PT-2024-19822 · Pypi+1 · Ecdsa+1

Alicja Kario + 1 · Published 2024-01-22 · Updated 2025-08-26 · CVE-2024-23342

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ecdsa versions 0.18.0 and prior

Description The ecdsa PyPI package, a pure Python implementation of ECC (Elliptic Curve Cryptography), is affected by a Minerva timing attack on the P-256 curve. This attack can leak the internal nonce when using the ecdsa.SigningKey.sign digest() API function, potentially allowing for private key discovery. The issue affects ECDSA signatures, key generation, and ECDH operations, but not ECDSA signature verification.

Recommendations For versions 0.18.0 and prior, as a temporary workaround, consider restricting the use of the ecdsa.SigningKey.sign digest() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

CWE-385

Related Identifiers

CVE-2024-23342

GHSA-WJ6H-64FC-37MP

RHSA-2024:10806

RHSA-2024:1878

Affected Products

Debian

Ecdsa

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23342.json · Exploit
• 🔥 https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp · Exploit
• https://osv.dev/vulnerability/CVE-2024-23342 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23342 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-23342 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23342 · Security Note
• https://osv.dev/vulnerability/GHSA-wj6h-64fc-37mp · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-23342 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23342 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-23342 · Security Note
• https://github.com/tlsfuzzer/python-ecdsa · Note
• https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md · Note
• https://twitter.com/CVEnew/status/1749574552898752873 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1749607489643872315 · Twitter Post
• https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python · Note