DSA-5132: -1 ecdsautils -- security update

Published May 8, 2022

Updated

ecdsautils - security update

Other sources

It was discovered that ecdsautils, a collection of ECDSA elliptic curve cryptography CLI tools verified some cryptographic signatures incorrectly: A signature consisting only of zeroes was always considered valid, making it trivial to forge signatures.

Affected Software

2 affected components

debian/ecdsautils

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ecdsautils to a version that resolves this vulnerability.
Patch DSA-5132-1

Event History

May 8, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-24884

Frequently Asked Questions

What does an attacker need to forge a signature?

The attacker only needs to provide a signature consisting entirely of zeroes. Affected ecdsautils verification incorrectly accepts that signature as valid.

Which workflows are exposed to this issue?

Any workflow that relies on ecdsautils CLI tools to verify ECDSA signatures may be exposed, because a zero-only signature can bypass the verification check.

DSA-5132: -1 ecdsautils -- security update

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to forge a signature?

Which workflows are exposed to this issue?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to forge a signature?

Which workflows are exposed to this issue?