# PYSEC-2020-182 - A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify…

Source: https://junglewise.ai/threats/pysec-2020-182-a-flaw-was-found-in-all-python-ecdsa-versions-before-0-bee0e6ea  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-01-02  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-01-02

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.

Technologies: [ecdsa (PyPI)](https://junglewise.ai/threats/technologies/ecdsa). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 2 January 2020.

**Which products and versions are affected?** ecdsa (PyPI) ECOSYSTEM:introduced=0,fixed=0.13.3.

**Is there a fix for This vulnerability?** Yes. ecdsa (PyPI): upgrade to 0.13.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run ecdsa (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ecdsa (PyPI): upgrade to 0.13.3 or later

  ```sh
  pip install "ecdsa>=0.13.3"
  ```


## Affected products

- ecdsa (PyPI) ECOSYSTEM:introduced=0,fixed=0.13.3

## Related threats

- [PYSEC-2026-1325 - Minerva timing attack on P-256 in python-ecdsa](https://junglewise.ai/threats/cve-2024-23342-minerva-timing-attack-on-p-256-in-python-ecdsa)
- [PYSEC-2026-2467 - python-ecdsa: Denial of Service via improper DER length validation in crafted private keys](https://junglewise.ai/threats/cve-2026-33936-python-ecdsa-denial-of-service-via-improper-der-length-validation)
- [Improper Verification of Cryptographic Signature in Pure-Python ECDSA](https://junglewise.ai/threats/cve-2019-14859-improper-verification-of-cryptographic-signature-in-pure-python)
- [ecdsa Denial of Service vulnerability in signature verification and signature malleability](https://junglewise.ai/threats/cve-2019-14853-python-ecdsa-malformed-signature-denial-of-service)