# CVE-2019-14859: Improper Verification of Cryptographic Signature in Pure-Python ECDSA

Source: https://junglewise.ai/threats/cve-2019-14859-improper-verification-of-cryptographic-signature-in-pure-python  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-01-02  
License: CC BY 4.0 with a link back

CVE-2019-14859 · Severity: low · CVSS 3.1 · Published 2020-01-02

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.

Technologies: [ecdsa (PyPI)](https://junglewise.ai/threats/technologies/ecdsa). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2019-14859 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-14859 being exploited in the wild.

**How severe is CVE-2019-14859?** Low severity, with a CVSS score of 3.1, published 2 January 2020.

**Which products and versions are affected?** ecdsa (PyPI) ECOSYSTEM:introduced=0,fixed=0.13.3.

**Is there a fix for CVE-2019-14859?** Yes. ecdsa (PyPI): upgrade to 0.13.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2019-14859?** Check whether you run ecdsa (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ecdsa (PyPI): upgrade to 0.13.3 or later

  ```sh
  pip install "ecdsa>=0.13.3"
  ```


## Affected products

- ecdsa (PyPI) ECOSYSTEM:introduced=0,fixed=0.13.3

## Identifiers

- CVE-2019-14859
- GHSA-8qxj-f9rh-9fg2
- PYSEC-2020-163

## Related threats

- [PYSEC-2026-1325 - Minerva timing attack on P-256 in python-ecdsa](https://junglewise.ai/threats/cve-2024-23342-minerva-timing-attack-on-p-256-in-python-ecdsa)
- [PYSEC-2026-2467 - python-ecdsa: Denial of Service via improper DER length validation in crafted private keys](https://junglewise.ai/threats/cve-2026-33936-python-ecdsa-denial-of-service-via-improper-der-length-validation)
- [PYSEC-2020-182 - A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify…](https://junglewise.ai/threats/pysec-2020-182-a-flaw-was-found-in-all-python-ecdsa-versions-before-0-bee0e6ea)
- [ecdsa Denial of Service vulnerability in signature verification and signature malleability](https://junglewise.ai/threats/cve-2019-14853-python-ecdsa-malformed-signature-denial-of-service)