Timing Attack Affecting ecdsa package, versions [0,]
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-ECDSA-6184115
- published 23 Jan 2024
- disclosed 22 Jan 2024
- credit Hubert Kario
Introduced: 22 Jan 2024
CVE-2024-23342 Open this link in a new tabHow to fix?
There is no fixed version for ecdsa.
Overview
ecdsa is an easy-to-use implementation of ECDSA cryptography (Elliptic Curve Digital Signature Algorithm), implemented purely in Python, released under the MIT license.
Affected versions of this package are vulnerable to Timing Attack via the sign_digest API function. An attacker can leak the internal nonce which may allow for private key discovery by timing signatures.
Notes:
This library was not designed with security in mind. If you are processing data that needs to be protected we suggest you use a quality wrapper around OpenSSL.
pyca/cryptographyis one example of such a wrapperThat means both
ECDSAsignatures, key generation andECDHoperations are affected.ECDSAsignature verification is unaffected.The maintainers don't plan to release a fix to this vulnerability.