The vulnerability of the Python ECDSA cryptographic library, related to improper verification of the cryptographic signature, allows a perpetrator to compromise the confidentiality and integrity of the protected information.

🗓️ 14 Apr 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Python ECDSA library improperly verifies signatures, enabling remote attackers to compromise data.

Reporter	Title	Published	Views	Family All 78
FreeBSD	security/py-ecdsa -- multiple issues	7 Oct 201900:00	–	freebsd
Amazon	Important: python-ecdsa	8 Aug 202300:00	–	amazon
Tenable Nessus	Amazon Linux AMI : python-ecdsa (ALAS-2023-1800)	14 Aug 202300:00	–	nessus
Tenable Nessus	Debian DLA-1978-1 : python-ecdsa security update	31 Oct 201900:00	–	nessus
Tenable Nessus	Debian DSA-4588-1 : python-ecdsa - security update	18 Dec 201900:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : python2-ecdsa (EulerOS-SA-2020-1711)	25 Jun 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization 3.0.6.0 : python-ecdsa (EulerOS-SA-2020-1773)	1 Jul 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : python-ecdsa (EulerOS-SA-2020-1824)	30 Jul 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : python-ecdsa (EulerOS-SA-2020-1929)	2 Sep 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.2.0 : python-ecdsa (EulerOS-SA-2020-1977)	8 Sep 202000:00	–	nessus

Vulners

Node

novell suse_enterprise_storageMatch4

OR

novell suse_openstack_cloudMatch7

OR

novell suse_linux_enterprise_module_for_additional_packagehubMatch15

OR

novell suse_caas_platformMatch3.0

OR

novell suse_linux_enterprise_module_for_development_toolsMatch15

OR

novell suse_linux_enterprise_module_for_public_cloudMatch12

OR

novell suse_linux_enterprise_module_for_public_cloudMatch15

OR

novell suse_openstack_cloudMatch8

OR

novell hpe_helion_openstackMatch8

OR

novell suse_openstack_cloudMatch9

OR

novell suse_manager_serverMatch3.2

OR

novell opensuse_leapMatch15.0

OR

novell opensuse_leapMatch15.1

Source	Link
suse	www.suse.com/security/cve/CVE-2019-14859/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-14859
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/warner/python-ecdsa/issues/114
github	www.github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3
pypi	www.pypi.org/project/ecdsa/0.13.3/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2019-14859
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
web	www.web.nvd.nist.gov/view/vuln/detail

21 Nov 2023 00:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 39.1

CVSS 29.4

EPSS0.01596

python ecdsa library signature verification remote attackers data confidentiality data integrity