CVE-2019-14859 Improper Verification of Cryptographic Signature in Pure-Python ECDSA
Attackers can exploit signature malleability in the python-ecdsa library to create false transactions by bypassing DER encoding verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14859?
CVE-2019-14859 is a high-severity vulnerability in Redhat Openstack, published on 2 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.
Weakness: CWE-347
Which versions are affected by CVE-2019-14859?
3 open source packages ship an affected version, including ecdsa. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
ecdsa PyPI | All versions | 0.13.3 |
ecdsa PyPI | All versions | 0.13.3 |
ecdsa PyPI | All versions | 0.13.3 |
Products include Python-Ecdsa Project Python-Ecdsa, Redhat Ceph Storage, Redhat Openstack, Redhat Virtualization.
How do I fix CVE-2019-14859?
Upgrade ecdsa to 0.13.3 or later.
Is CVE-2019-14859 being exploited?
There is no known exploitation of CVE-2019-14859 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openstack
Sources
Also known as DEBIAN-CVE-2019-14859, GHSA-8qxj-f9rh-9fg2, PYSEC-2020-163, UBUNTU-CVE-2019-14859.