CRITICAL9.8

GHSA-q9q6-f556-gpm7

Improper Verification of Cryptographic Signature in starkbank-ecdsa

Quick fix

GHSA-q9q6-f556-gpm7 — starkbank-ecdsa: upgrade to the fixed version with the command below.

npm install starkbank-ecdsa@1.1.3

Details

The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/starkbank-ecdsa

Introduced in: 0Fixed in: 1.1.3

Fixnpm install starkbank-ecdsa@1.1.3

References

https://nvd.nist.gov/vuln/detail/CVE-2021-43571[ADVISORY]
https://github.com/starkbank/ecdsa-node[PACKAGE]
https://github.com/starkbank/ecdsa-node/releases/tag/v1.1.3[WEB]
https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries[WEB]