python-ecdsa

Pure-Python ECDSA and ECDH 这是一个易于使用的 ECC（椭圆曲线密码学）实现，支持 ECDSA（椭圆曲线数字签名算法）、EdDSA（爱德华曲线数字签名算法）和 ECDH（椭圆曲线 Diffie-Hellman），完全用纯 Python 实现，并以 MIT 许可证发布。使用此库，您可以快速创建密钥对（签名密钥和验证密钥）、对消息签名并验证签名。您还可以基于交换的公钥协商出共享密钥。密钥和签名都非常短，易于处理并集成到其他协议中。 注意：此库不应在生产环境中使用，详情请参阅Security。 特性 此库为五种流行的 NIST“Suite B”GFp（ 素数域...

CVE-2026-33936

CVE-2026-33936 ecdsa PyPI 中的拒绝服务漏洞 介绍 我在 python-ecdsa 中识别并负责任地披露了一个 中等严重性 的漏洞，这是一个广泛使用的 Python 加密库，过去一个月有 4780 万次下载 。 我在审查 python-ecdsa 时发现了这个问题，心中带着一个非常具体的问题： 如果格式错误的 DER 虚假地声称其长度，而解析器过度信任该长度，会发生什么？ 在这个案例中，这个问题引出了一个真实漏洞。 ecdsa.der 中的 DER...

DEBIAN-CVE-2024-47220

An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webric...

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

...

CVE-2021-28861

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states...

Information disclosure

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

CVE-2022-31186 Leakage of excessive information into log in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...