CVE-2024-23342

Advisory

[This advisory has been limited. Please create a free account to view the full advisory.]

Affected package

Affected versions

[This affected versions has been limited. Please create a free account to view the full affected versions.]

Fixed versions

[This fixed versions has been limited. Please create a free account to view the full fixed versions.]

Vulnerability changelog

The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists. See CVE-2024-23342.


MISC:https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md: https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md
MISC:https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp: https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp
MISC:https://minerva.crocs.fi.muni.cz/: https://minerva.crocs.fi.muni.cz/
MISC:https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/: https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/

Resources

• https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md
• https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp
• https://minerva.crocs.fi.muni.cz/
• https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23342