CVE-2021-43569

The verify function in the Stark Bank .NET ECDSA library ecdsa-dotnet 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...

CVE-2021-43569

The CVE-2021-43569 vulnerability affects Stark Bank’s .NET ECDSA library (ecdsa-dotnet) 1.3.1, where the verify function does not reject a zero/non-nonzero signature, enabling signature forgery on arbitrary messages and potential authentication bypass. Public details confirm the issue and point t...

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...

Stark Bank 数据伪造问题漏洞

Stark Bank is a banking API for individual developers in Brazil that performs all banking operations through the API, simplifying and automating payments, facilitating reconciliations, and scaling operations. a data forgery issue vulnerability exists in Stark Bank python-ecdsa, which stems from t...

Stark Bank 数据伪造问题漏洞

Stark Bank is a banking API for individual developers in Brazil. performs all banking operations through the API, simplifying and automating payments, facilitating reconciliations and scaling operations. A data forgery issue vulnerability exists in Stark Bank Ecdsa-java, which stems from a failur...

c7n-mailer (>=0.6.4 <=0.6.12), jesse (>=2.2.0 <=2.3.4) +7 more potentially affected by unknown CVE via starkbank-ecdsa (>=1.0.0 <=1.1.1)

starkbank-ecdsa PYPI version =1.0.0, =0.6.4, =2.2.0, =1.0.1, =1.0.1, =1.3.0, =6.8.3, =6.9.0 - starkbank =0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-9WX7-JRVC-28MM...

Signature verification vulnerability in Stark Bank ecdsa libraries

An attacker can forge signatures on arbitrary messages that will verify for any public key. This may allow attackers to authenticate as any user within the Stark Bank platform, and bypass signature verification needed to perform operations on the platform, such as send payments and transfer funds...

GHSA-9WX7-JRVC-28MM Signature verification vulnerability in Stark Bank ecdsa libraries

An attacker can forge signatures on arbitrary messages that will verify for any public key. This may allow attackers to authenticate as any user within the Stark Bank platform, and bypass signature verification needed to perform operations on the platform, such as send payments and transfer funds...

PT-2022-2323

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7u331, 8u321, 11.0.14, 17.0.2, 18 Oracle GraalVM Enterprise Edition versions 20.3.5, 21.3.1, 22.0.0.2 Description The issue is related to the implementation of the ECDSA digital signature algorithm in Oracle Java SE and...

GHSA-56WV-2WR9-3H9R Improper Verification of Cryptographic Signature in fastecdsa

An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s-1, the signature verification fails even if the signature is correct. This behavior is not solely a...

Improper Verification of Cryptographic Signature in fastecdsa

An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s-1, the signature verification fails even if the signature is correct. This behavior is not solely a...

functions permit and permitAll can be tricked by an invalid signature

Handle pauliax Vulnerability details Impact When the signature is not valid, ecrecover returns empty 0x0 address. There is a potential check against that: require recoveredAddress != address0 && recoveredAddress == owner || isApprovedForAllownerrecoveredAddress, "INVALIDPERMITSIGNATURE" ; However...

SUSE-RU-2021:14818-1 Recommended update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr fixes the following issues: mozilla-nspr was updated to version 4.32: implement new socket option PRSockOptDontFrag support larger DNS records by increasing the default buffer size for DNS queries Lock access to PRCallOnceType members in PRCallOnce for thread safety...

Security Bulletin: Power Hardware Management Console is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Problem Security vulnerabilities have been discovered in OpenSSL. Resolving The Problem Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could...

SUSE-RU-2021:3115-2 Recommended update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr fixes the following issues: mozilla-nspr was updated to version 4.32: implement new socket option PRSockOptDontFrag support larger DNS records by increasing the default buffer size for DNS queries Lock access to PRCallOnceType members in PRCallOnce for thread safety...

Debian: Security Advisory (DLA-2760-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...

SUSE-RU-2021:3115-1 Recommended update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr fixes the following issues: mozilla-nspr was updated to version 4.32: implement new socket option PRSockOptDontFrag support larger DNS records by increasing the default buffer size for DNS queries Lock access to PRCallOnceType members in PRCallOnce for thread safety...

Huawei EulerOS: Security Advisory for python-ecdsa (EulerOS-SA-2021-2429)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP2 : python-ecdsa (EulerOS-SA-2021-2429)

According to the version of the python-ecdsa package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without...