Search for packages
| purl | pkg:pypi/fastecdsa@1.0.1b2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-8nfq-s4yw-5yab
Aliases: CVE-2024-21502 GHSA-ph86-g9r3-5qw4 PYSEC-2024-39 |
Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability. |
Affected by 0 other vulnerabilities. |
|
VCID-wu1n-6amw-tfd3
Aliases: CVE-2020-12607 GHSA-56wv-2wr9-3h9r PYSEC-2020-42 |
An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||