Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/fastecdsa@2.3.2
Typepypi
Namespace
Namefastecdsa
Version2.3.2
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_versionnull
Latest_non_vulnerable_versionnull
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-8nfq-s4yw-5yab
vulnerability_id VCID-8nfq-s4yw-5yab
summary Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability.
references
0
reference_url https://gist.github.com/keltecc/49da037072276f21b005a8337c15db26
reference_id
reference_type
scores
url https://gist.github.com/keltecc/49da037072276f21b005a8337c15db26
1
reference_url https://github.com/AntonKueltz/fastecdsa
reference_id
reference_type
scores
url https://github.com/AntonKueltz/fastecdsa
2
reference_url https://github.com/AntonKueltz/fastecdsa/blob/v2.3.1/src/curveMath.c%23L210
reference_id
reference_type
scores
url https://github.com/AntonKueltz/fastecdsa/blob/v2.3.1/src/curveMath.c%23L210
3
reference_url https://github.com/AntonKueltz/fastecdsa/commit/57fc5689c95d649dab7ef60cc99ac64589f01e36
reference_id
reference_type
scores
url https://github.com/AntonKueltz/fastecdsa/commit/57fc5689c95d649dab7ef60cc99ac64589f01e36
4
reference_url https://security.snyk.io/vuln/SNYK-PYTHON-FASTECDSA-6262045
reference_id
reference_type
scores
url https://security.snyk.io/vuln/SNYK-PYTHON-FASTECDSA-6262045
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-21502
reference_id CVE-2024-21502
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2024-21502
6
reference_url https://github.com/advisories/GHSA-ph86-g9r3-5qw4
reference_id GHSA-ph86-g9r3-5qw4
reference_type
scores
url https://github.com/advisories/GHSA-ph86-g9r3-5qw4
fixed_packages
0
url pkg:pypi/fastecdsa@2.3.2
purl pkg:pypi/fastecdsa@2.3.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/fastecdsa@2.3.2
aliases CVE-2024-21502, GHSA-ph86-g9r3-5qw4, PYSEC-2024-39
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8nfq-s4yw-5yab
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/fastecdsa@2.3.2