Quick answers
- Is CVE-2019-14853 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2019-14853 being exploited in the wild.
- How severe is CVE-2019-14853?
- Low severity, with a CVSS score of 3.1, published 26 November 2019.
- Which products and versions are affected?
- ecdsa (PyPI) ECOSYSTEM:introduced=0,fixed=0.13.3.
- Is there a fix for CVE-2019-14853?
- Yes. ecdsa (PyPI): upgrade to 0.13.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2019-14853 attacked?
- It is attacked over the network.
- Am I affected by CVE-2019-14853?
- Check whether you run ecdsa (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- ecdsa (PyPI): upgrade to 0.13.3 or later
pip install "ecdsa>=0.13.3"
Technical details
The vulnerability exists in the signature decoding logic of python-ecdsa (versions prior to 0.13.3), where malformed or invalid signature input triggers unexpected and undocumented exceptions rather than being handled gracefully. An attacker can craft malformed ECDSA signatures that, when processed by an application using the library, cause the application to raise exceptions and potentially crash. The attack is triggered when an application attempts to verify or decode a signature; no authentication is required. The fix is available in version 0.13.3 and later.
Affected products
- python-ecdsa ecdsa before 0.13.3
Identifiers
- CVE-2019-14853
- GHSA-2mrj-435v-c2cr
- GHSA-pwfw-mgfj-7g3g
- PYSEC-2019-177
Timeline
- 2019-10-04: disclosed
- 2019-10-07: patched: Version 0.13.3 released
- 2019-12-02: advisory
- 2020-06-16: other: Advisory withdrawn as duplicate of GHSA-pwfw-mgfj-7g3g