Upgrading ecdsa 0.12 to 0.13
Safe0.12 → 0.13.3Security3Fixed3
SecurityFixes CVE-2019-14853, a possible DoS caused by malformed signature decoding.GHSA-2mrj-435v-c2cr · CVE-2019-14853 ↗
SafeUpgrade verdict
3 security fixes. Nothing to change in your code.
In plain terms
- A malformed signature could crash or hang the library; this update makes decoding reject it safely.
- Weak checks on signature encoding allowed the same signature to be written in more than one way; this update enforces strict DER encoding.
- Key parsing is made stricter so malformed or maliciously crafted keys are rejected.
Must act 3 items need code or config changes
What you must change
Security3
Fixes CVE-2019-14853, a possible DoS caused by malformed signature decoding.
Fixes CVE-2019-14859, signature malleability caused by insufficient checks of DER encoding.
Hardens key decoding from string and DER encodings.