Miggo Logo
Miggo Vulnerability Database
→
GHSA-9wx7-jrvc-28mm

GHSA-9wx7-jrvc-28mm:
Signature verification vulnerability in Stark Bank ecdsa libraries

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-9wx7-jrvc-28mm
EPSS Score
-
CWE
CWE-347
Published
11/8/2021
Updated
3/31/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
starkbank-ecdsapip< 2.0.12.0.1
com.starkbank:ecdsa-javamaven= 1.0.01.0.1
starkbank-ecdsanuget= 1.3.11.3.2
starkbank-ecdsanpm= 1.1.21.1.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The GitHub patch explicitly adds range checks for signature.r and signature.s in the verify() method of ecdsa.py. This matches the vulnerability description about signature forgery through improper cryptographic verification (CWE-347). The absence of these checks in pre-patch versions would allow acceptance of mathematically invalid signatures. While other language implementations (Java/Node/.NET) are also affected, the Python diff provides direct evidence of the vulnerable function location.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n *tt**k*r **n *or** si*n*tur*s on *r*itr*ry m*ss***s t**t will v*ri*y *or *ny pu*li* k*y. T*is m*y *llow *tt**k*rs to *ut**nti**t* *s *ny us*r wit*in t** St*rk **nk pl*t*orm, *n* *yp*ss si*n*tur* v*ri*i**tion n***** to p*r*orm op*r*tions on t** pl*

Reasoning

T** *it*u* p*t** *xpli*itly ***s r*n** ****ks *or `si*n*tur*.r` *n* `si*n*tur*.s` in t** `v*ri*y()` m*t*o* o* `***s*.py`. T*is m*t***s t** vuln*r**ility **s*ription **out si*n*tur* *or**ry t*rou** improp*r *rypto*r*p*i* v*ri*i**tion (*W*-***). T** **