GHSA-9wx7-jrvc-28mm json
Signature verification vulnerability in Stark Bank ecdsa libraries
published 5y ago modified last yr.
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
An attacker can forge signatures on arbitrary messages that will verify for any public key. This may allow attackers to authenticate as any user within the Stark Bank platform, and bypass signature verification needed to perform operations on the platform, such as send payments and transfer funds. Additionally, the ability for attackers to forge signatures may impact other users and projects using these libraries in different and unforeseen ways.
Patch / fix
- pypi starkbank-ecdsa 2.0.1
- maven com.starkbank:ecdsa-java 1.0.1
- nuget starkbank-ecdsa 1.3.2
- npm starkbank-ecdsa 1.1.3
Is GHSA-9wx7-jrvc-28mm in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | starkbank-ecdsa | <2.0.1 |
2.0.1 |
| maven | com.starkbank:ecdsa-java | >=1.0.0, <1.0.1 |
1.0.1 |
| nuget | starkbank-ecdsa | >=1.3.1, <1.3.2 |
1.3.2 |
| npm | starkbank-ecdsa | >=1.1.2, <1.1.3 |
1.1.3 |
Classification
- Weakness
-
- CWE-347 Improper Verification of Cryptographic Signature
References
-
github.com
/starkbank/ecdsa-python/commit/d136170666e9510eb63c2572551805807bd4c17f
web
-
github.com
/starkbank/ecdsa-dotnet
web
-
github.com
/starkbank/ecdsa-java
web
-
github.com
/starkbank/ecdsa-node
web
-
github.com
/starkbank/ecdsa-python
package
-
github.com
/starkbank/ecdsa-python/compare/v2.0.0...v2.0.1
web
-
github.com
/starkbank/ecdsa-python/releases/tag/v2.0.1
web
-
research.nccgroup.com
/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries
web
Sources
- GitHub Advisory GHSA-9wx7-jrvc-28mm
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.