CVE-2019-14853

Python-ecdsa < 0.13.3: Flaw in handling malformed DER signatures can lead to denial of service

• CVSS 7.5
• CWE-755
• Input Validation and Sanitization
• Remote

An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.

CVE

CVE-2019-14853

CWE

CWE-755

CVSS base score

7.5

Published

2019-11-26

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update python-ecdsa to version 0.13.3 or higher.

from ecdsa import VerifyingKey

def verify_signature(public_key_bytes, signature, message):
    vk = VerifyingKey.from_string(public_key_bytes)
    vk.verify(signature, message)

from ecdsa import VerifyingKey, BadSignatureError

def verify_signature(public_key_bytes, signature, message):
    try:
        vk = VerifyingKey.from_string(public_key_bytes)
        vk.verify(signature, message)
    except BadSignatureError:
        print("Invalid signature.")
    except Exception as e:
        print(f"An error occurred: {e}")

@misc{vaitp:cve201914853,
  title        = {{Python-ecdsa < 0.13.3: Flaw in handling malformed DER signatures can lead to denial of service}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-14853},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-14853/}}
}