—

PYSEC-2021-426

Quick fix

PYSEC-2021-426 — starkbank-ecdsa: upgrade to the fixed version with the command below.

pip install --upgrade 'starkbank-ecdsa>=2.0.1'

Details

The verify function in the Stark Bank Python ECDSA library (ecdsa-python) 2.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/starkbank-ecdsa

Introduced in: 0Fixed in: 2.0.1

Fixpip install --upgrade 'starkbank-ecdsa>=2.0.1'

References

https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/[ADVISORY]
https://github.com/starkbank/ecdsa-python/releases/tag/v2.0.1[WEB]
https://github.com/advisories/GHSA-92vm-mxjf-jqf3[ADVISORY]