CRITICAL9.8

GHSA-j3jw-j2j8-2wv9

Improper Verification of Cryptographic Signature in starkbank-ecdsa

Quick fix

GHSA-j3jw-j2j8-2wv9 — starkbank-ecdsa: upgrade to the fixed version with the command below.

dotnet add package starkbank-ecdsa --version 1.3.2

Details

The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/starkbank-ecdsa

Introduced in: 0Fixed in: 1.3.2

Fixdotnet add package starkbank-ecdsa --version 1.3.2

References

https://nvd.nist.gov/vuln/detail/CVE-2021-43569[ADVISORY]
https://github.com/starkbank/ecdsa-dotnet[PACKAGE]
https://github.com/starkbank/ecdsa-dotnet/releases/tag/v1.3.2[WEB]
https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries[WEB]