python-ecdsa

純Python製 ECDSA および ECDH これは、ECC（楕円曲線暗号）の使いやすい実装です。 ECDSA（楕円曲線デジタル署名アルゴリズム）、 EdDSA（エドワーズ曲線デジタル署名アルゴリズム）、および ECDH （楕円曲線ディフィー・ヘルマン）をサポートし、純粋な Python で実装され、 MIT ライセンスで公開されています。このライブラリを使用すると、鍵ペア（署名 鍵と検証鍵）をすばやく作成し、メッセージに署名して、署名を検証できます。また、 交換した公開鍵に基づいて共有秘密鍵に合意することもできます。 鍵と署名は非常に短いため、取り扱いが容易で、...

CVE-2024-42461

Решение проблем проверки подписей ECDSA и EDDSA Описание В проекте Wycheproof были выявлены проблемы при проверке подписей ECDSA и EDDSA. Отсутствующие проверки на этапе декодирования подписей позволяют добавлять или удалять нулевые байты, что влияет на возможность отправки писем. Данное обновлен...

CVE-2026-33936

CVE-2026-33936 ecdsaPyPI의 서비스 거부Denial of Service 취약점 소개 저는 널리 사용되는 Python 암호화 라이브러리인 python-ecdsa 에서 중간Moderate 심각도 취약점을 식별하고 책임 있는 공개responsible disclosure를 수행했습니다. 이 라이브러리는 지난 한 달간 4,780만 회 다운로드되었습니다. 저는 아주 구체적인 질문을 염두에 두고 python-ecdsa 를 검토하던 중 이 문제를 발견했습니다: 잘못된 형식의 DER이 길이를 속이고 파서가 이를 지나치게 신뢰...

Astra Linux – Vulnerability in Node-Elliptic

The verify function in lib/elliptic/eddsa/index.js within the Elliptic package, as of version 6.5.6 for Node.js, omits the validation of the condition “sig.S.gtesig.eddsa.curve.n || sig.S.isNeg”...

EulerOS 2.0 SP11 : libsolv (EulerOS-SA-2026-3078)

According to the versions of the libsolv packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted .solv file containing...

EulerOS 2.0 SP13 : libsolv (EulerOS-SA-2026-2976)

According to the versions of the libsolv packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handlin...

CLSA-2026-1770682157 TuxCare security update for net.i2p.crypto:eddsa (1 CVE)

TuxCare rebuilt net.i2p.crypto:eddsa to address 1 CVE. Fixed in 0.3.0-tuxcare.1...

Security Bulletin: Security Vulnerability in EdDSA-Java affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2020-36843)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to EdDSA-Java's implementation of the cryptographic algorithm. Vulnerability Details CVEID:CVE-2020-36843 DESCRIPTION: The implementation of EdDSA in EdDSA-Java aka ed25519-java through 0.3.0 exhibi...

CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47121

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47121

Sparkle vulnerability CVE-2026-47121 (affecting macOS AutoUpdate) arises from a defense-in-depth gap in delta application. An archive item can create a symlink in the destination tree and a subsequent file write may traverse the symlink path, allowing writes outside the intended destination when ...

Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

...

CVE-2026-48863

The CVE-2026-48863 issue is a stack-based buffer overflow in libsolv’s EdDSA verification when copying the EdDSA 's' MPI, caused by length handling. An adversary could craft an Ed25519 PGP signature with mismatched MPI lengths to trigger a denial of service in automated package/repo processing wo...

CVE-2026-48863 Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processin...

CVE-2026-48863: Stack-based Buffer Overflow

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processin...

Security update for libsolv, libzypp, zypper

This update for libsolv, libzypp, zypper fixes the following issues CVE-2026-9149: Heap buffer overflow in libsolv repoaddsolv via negative maxsize from crafted .solv file bsc1265935. CVE-2026-9150: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512...

Security update for libsolv, libzypp, zypper

This update for libsolv, libzypp, zypper fixes the following issues CVE-2026-9149: Heap buffer overflow in libsolv repoaddsolv via negative maxsize from crafted .solv file bsc1265935. CVE-2026-9150: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512...

SUSE-SU-2026:2575-1 Security update for libsolv, libzypp, zypper

This update for libsolv, libzypp, zypper fixes the following issues - CVE-2026-9149: Heap buffer overflow in libsolv repoaddsolv via negative maxsize from crafted .solv file bsc1265935. - CVE-2026-9150: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512...

Security update for apache-sshd, jpgpj

This update for apache-sshd, jpgpj fixes the following issues CVE-2020-36843: no check performed on scalar to avoid signature malleability bsc1239551. CVE-2026-48827: Apache MINA SSHD: Path traversal in org.apache.sshd: sshd-git bsc1267018. Changes for jpgpj: Initial packaging with v1.3 Changes f...

OESA-2026-2635 libsolv security update

A free package dependency solver using a satisfiability algorithm. The library is based on two major, but independent, blocks: Security Fixes: A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when...