Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-ebg3-6ssf-dkcy
Summary
Minerva timing attack on P-256 in python-ecdsa
python-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the `ecdsa.SigningKey.sign_digest()` API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key generation, and ECDH operations are affected. ECDSA signature verification is unaffected. The python-ecdsa project considers side channel attacks out of scope for the project and there is no planned fix.
Aliases
0
alias CVE-2024-23342
1
alias GHSA-wj6h-64fc-37mp
Fixed_packages
Affected_packages
0
url pkg:pypi/ecdsa@0
purl pkg:pypi/ecdsa@0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0
1
url pkg:pypi/ecdsa@0.6
purl pkg:pypi/ecdsa@0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9pe3-67b4-yqae
1
vulnerability VCID-acg5-4qjn-sudc
2
vulnerability VCID-ebg3-6ssf-dkcy
3
vulnerability VCID-qrf7-gnjg-bfat
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.6
2
url pkg:pypi/ecdsa@0.7
purl pkg:pypi/ecdsa@0.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9pe3-67b4-yqae
1
vulnerability VCID-acg5-4qjn-sudc
2
vulnerability VCID-ebg3-6ssf-dkcy
3
vulnerability VCID-qrf7-gnjg-bfat
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.7
3
url pkg:pypi/ecdsa@0.8
purl pkg:pypi/ecdsa@0.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9pe3-67b4-yqae
1
vulnerability VCID-acg5-4qjn-sudc
2
vulnerability VCID-ebg3-6ssf-dkcy
3
vulnerability VCID-qrf7-gnjg-bfat
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.8
4
url pkg:pypi/ecdsa@0.9
purl pkg:pypi/ecdsa@0.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9pe3-67b4-yqae
1
vulnerability VCID-acg5-4qjn-sudc
2
vulnerability VCID-ebg3-6ssf-dkcy
3
vulnerability VCID-qrf7-gnjg-bfat
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.9
5
url pkg:pypi/ecdsa@0.10
purl pkg:pypi/ecdsa@0.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9pe3-67b4-yqae
1
vulnerability VCID-acg5-4qjn-sudc
2
vulnerability VCID-ebg3-6ssf-dkcy
3
vulnerability VCID-qrf7-gnjg-bfat
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.10
6
url pkg:pypi/ecdsa@0.11
purl pkg:pypi/ecdsa@0.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9pe3-67b4-yqae
1
vulnerability VCID-acg5-4qjn-sudc
2
vulnerability VCID-ebg3-6ssf-dkcy
3
vulnerability VCID-qrf7-gnjg-bfat
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.11
7
url pkg:pypi/ecdsa@0.12
purl pkg:pypi/ecdsa@0.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9pe3-67b4-yqae
1
vulnerability VCID-acg5-4qjn-sudc
2
vulnerability VCID-ebg3-6ssf-dkcy
3
vulnerability VCID-qrf7-gnjg-bfat
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.12
8
url pkg:pypi/ecdsa@0.13
purl pkg:pypi/ecdsa@0.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9pe3-67b4-yqae
1
vulnerability VCID-acg5-4qjn-sudc
2
vulnerability VCID-ebg3-6ssf-dkcy
3
vulnerability VCID-qrf7-gnjg-bfat
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.13
9
url pkg:pypi/ecdsa@0.13.1
purl pkg:pypi/ecdsa@0.13.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9pe3-67b4-yqae
1
vulnerability VCID-acg5-4qjn-sudc
2
vulnerability VCID-ebg3-6ssf-dkcy
3
vulnerability VCID-qrf7-gnjg-bfat
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.13.1
10
url pkg:pypi/ecdsa@0.13.2
purl pkg:pypi/ecdsa@0.13.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9pe3-67b4-yqae
1
vulnerability VCID-acg5-4qjn-sudc
2
vulnerability VCID-ebg3-6ssf-dkcy
3
vulnerability VCID-qrf7-gnjg-bfat
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.13.2
11
url pkg:pypi/ecdsa@0.13.3
purl pkg:pypi/ecdsa@0.13.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.13.3
12
url pkg:pypi/ecdsa@0.14
purl pkg:pypi/ecdsa@0.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.14
13
url pkg:pypi/ecdsa@0.14.1
purl pkg:pypi/ecdsa@0.14.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.14.1
14
url pkg:pypi/ecdsa@0.15
purl pkg:pypi/ecdsa@0.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.15
15
url pkg:pypi/ecdsa@0.16.0
purl pkg:pypi/ecdsa@0.16.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.16.0
16
url pkg:pypi/ecdsa@0.16.1
purl pkg:pypi/ecdsa@0.16.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.16.1
17
url pkg:pypi/ecdsa@0.17.0
purl pkg:pypi/ecdsa@0.17.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.17.0
18
url pkg:pypi/ecdsa@0.18.0b1
purl pkg:pypi/ecdsa@0.18.0b1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.18.0b1
19
url pkg:pypi/ecdsa@0.18.0b2
purl pkg:pypi/ecdsa@0.18.0b2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.18.0b2
20
url pkg:pypi/ecdsa@0.18.0
purl pkg:pypi/ecdsa@0.18.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ecdsa@0.18.0
21
url pkg:rpm/redhat/python-ecdsa@0.18.0-4?arch=el8ui
purl pkg:rpm/redhat/python-ecdsa@0.18.0-4?arch=el8ui
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/python-ecdsa@0.18.0-4%3Farch=el8ui
22
url pkg:rpm/redhat/python-pulp-container@2.16.9-2?arch=el8pc
purl pkg:rpm/redhat/python-pulp-container@2.16.9-2?arch=el8pc
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ebg3-6ssf-dkcy
resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/python-pulp-container@2.16.9-2%3Farch=el8pc
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-23342.json
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-23342.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-23342
reference_id
reference_type
scores
0
value 0.00622
scoring_system epss
scoring_elements 0.70122
published_at 2026-04-21T12:55:00Z
1
value 0.00622
scoring_system epss
scoring_elements 0.70143
published_at 2026-04-18T12:55:00Z
2
value 0.00622
scoring_system epss
scoring_elements 0.70133
published_at 2026-04-16T12:55:00Z
3
value 0.00622
scoring_system epss
scoring_elements 0.70038
published_at 2026-04-02T12:55:00Z
4
value 0.00622
scoring_system epss
scoring_elements 0.70103
published_at 2026-04-12T12:55:00Z
5
value 0.00622
scoring_system epss
scoring_elements 0.70117
published_at 2026-04-11T12:55:00Z
6
value 0.00622
scoring_system epss
scoring_elements 0.70094
published_at 2026-04-09T12:55:00Z
7
value 0.00622
scoring_system epss
scoring_elements 0.70078
published_at 2026-04-08T12:55:00Z
8
value 0.00622
scoring_system epss
scoring_elements 0.70031
published_at 2026-04-07T12:55:00Z
9
value 0.00622
scoring_system epss
scoring_elements 0.70053
published_at 2026-04-04T12:55:00Z
10
value 0.00622
scoring_system epss
scoring_elements 0.7009
published_at 2026-04-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-23342
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23342
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23342
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/tlsfuzzer/python-ecdsa
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/tlsfuzzer/python-ecdsa
5
reference_url https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-05-08T15:35:54Z/
url https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md
6
reference_url https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-05-08T15:35:54Z/
url https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp
7
reference_url https://minerva.crocs.fi.muni.cz
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://minerva.crocs.fi.muni.cz
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-23342
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-23342
9
reference_url https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2259780
reference_id 2259780
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2259780
11
reference_url https://github.com/advisories/GHSA-wj6h-64fc-37mp
reference_id GHSA-wj6h-64fc-37mp
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-wj6h-64fc-37mp
12
reference_url https://access.redhat.com/errata/RHSA-2024:10806
reference_id RHSA-2024:10806
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:10806
13
reference_url https://access.redhat.com/errata/RHSA-2024:1878
reference_id RHSA-2024:1878
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1878
Weaknesses
0
cwe_id 203
name Observable Discrepancy
description The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
1
cwe_id 208
name Observable Timing Discrepancy
description Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
2
cwe_id 385
name Covert Timing Channel
description Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
3
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
4
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score7.0 - 8.9
Exploitability0.5
Weighted_severity8.0
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-ebg3-6ssf-dkcy