CVE-2019-14859: Critical severity red hat python-ecdsa vulnerability
A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.
Other sources
A flaw was found in python-ecdsa before 0.13.3. The library is not verifying if the signatures actually use DER encoding for the signatures. This makes the signatures malleable and exposes use cases that further sign the signatures. In particular bitcoin.
Upstream issue:
https://github.com/warner/python-ecdsa/issues/114
Upstream patch:
https://github.com/warner/python-ecdsa/pull/115 https://github.com/warner/python-ecdsa/pull/124
References:
https://en.bitcoinwiki.org/wiki/TransactionMalleability
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-14859?
CVE-2019-14859 is a vulnerability found in all python-ecdsa versions before 0.13.3. It allows for the acceptance of malformed signatures, making the signature malleable.
What is the severity of CVE-2019-14859?
CVE-2019-14859 has a severity score of 9.1, which is considered critical.
How does CVE-2019-14859 affect software?
CVE-2019-14859 affects python-ecdsa versions before 0.13.3, including packages from pip, redhat, and debian, as well as the Python-ecdsa Project.
How do I fix CVE-2019-14859?
To fix CVE-2019-14859, update to python-ecdsa version 0.13.3 or later.
Where can I find more information about CVE-2019-14859?
You can find more information about CVE-2019-14859 in the National Vulnerability Database (NVD) at https://nvd.nist.gov/vuln/detail/CVE-2019-14859.