CVE-2019-14853

Name of the Vulnerable Software and Affected Versions python-ecdsa versions 0.5 through 0.13.2

Description A flaw in the error-handling mechanism of python-ecdsa could lead to a denial of service when decoding malformed DER signatures. This issue may cause unexpected exceptions or no exceptions at all, potentially resulting in program termination. The vulnerability also allows for signature malleability, which could impact applications that sign or verify signatures of signatures, such as Bitcoin.

Recommendations For python-ecdsa versions 0.5 through 0.13.2, update to version 0.13.3 to resolve the issue. As a temporary workaround, consider catching additional exceptions such as UnexpectedDER, IndexError, and AssertionError when using VerifyingKey.verify() and VerifyingKey.verify digest() to prevent denial of service. To remediate signature malleability, verify that the signature is properly DER formatted ECDSA-Sig-Value before passing it to verify() or verify digest() methods.