CVE-2024-23342

Minerva attack vulnerability in ecdsa PyPI package (before 0.18.0)

• CVSS 7.4
• CWE-203
• Cryptographic
• Remote

The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.

CVE

CVE-2024-23342

CWE

CWE-203

CVSS base score

7.4

Published

2024-01-22

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Cryptographic

Subcategory

Inadequate random number generation

Accessibility scope

Remote

Impact

Information Disclosure

Solution

No known patched version exists (05-02-2024)

from ecdsa import SigningKey, NIST256p

sk = SigningKey.generate(curve=NIST256p)
vk = sk.verifying_key

message = b"Secure message"
signature = sk.sign(message)

assert vk.verify(signature, message)
print("Signature verified.")

from ecdsa import SigningKey, NIST256p
import os

def generate_secure_key():
    sk = SigningKey.generate(curve=NIST256p)
    return sk

def sign_message(sk, message):
    return sk.sign(message)

def verify_signature(vk, signature, message):
    try:
        vk.verify(signature, message)
        return True
    except:
        return False

sk = generate_secure_key()
vk = sk.verifying_key

message = b"Secure message"
signature = sign_message(sk, message)

if verify_signature(vk, signature, message):
    print("Signature verified.")
else:
    print("Signature verification failed.")

@misc{vaitp:cve202423342,
  title        = {{Minerva attack vulnerability in ecdsa PyPI package (before 0.18.0)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-23342},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-23342/}}
}