CVE-2019-14859

Name of the Vulnerable Software and Affected Versions python-ecdsa versions prior to 0.13.3

Description A flaw was found in the python-ecdsa library where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. An attacker could use a malleable signature to create false transactions, potentially impacting the confidentiality and integrity of protected information.

Recommendations For versions prior to 0.13.3, update to version 0.13.3 or later to resolve the issue. As a temporary workaround, consider implementing additional signature verification measures to minimize the risk of exploitation. Restrict the use of the python-ecdsa library until a patch is applied.