Signature verification vulnerability in Stark Bank ecdsa libraries
Priority LOW 38CWE-347Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-347.
Summary
An attacker can forge signatures on arbitrary messages that will verify for any public key. This may allow attackers to authenticate as any user within the Stark Bank platform, and bypass signature verification needed to perform operations on the platform, such as send payments and transfer funds. Additionally, the ability for attackers to forge signatures may impact other users and projects using these libraries in different and unforeseen ways.
Why it matters now
Fix Fixed starkbank-ecdsa (PyPI): 2.0.1com.starkbank:ecdsa-java (Maven): 1.0.1+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | starkbank-ecdsa (PyPI) | before 2.0.1 | 2.0.1 | Patch available | GHSA-9wx7-jrvc-28mm |
| — | com.starkbank:ecdsa-java (Maven) | 1.0.0 to before 1.0.1 | 1.0.1 | Patch available | GHSA-9wx7-jrvc-28mm |
| — | starkbank-ecdsa (NuGet) | 1.3.1 to before 1.3.2 | 1.3.2 | Patch available | GHSA-9wx7-jrvc-28mm |
| — | starkbank-ecdsa (npm) | 1.1.2 to before 1.1.3 | 1.1.3 | Patch available | GHSA-9wx7-jrvc-28mm |
- starkbank-ecdsa (PyPI) Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available GHSA-9wx7-jrvc-28mm
- com.starkbank:ecdsa-java (Maven) Vendor— Affected 1.0.0 to before 1.0.1 Fixed in 1.0.1 Patch available GHSA-9wx7-jrvc-28mm
- starkbank-ecdsa (NuGet) Vendor— Affected 1.3.1 to before 1.3.2 Fixed in 1.3.2 Patch available GHSA-9wx7-jrvc-28mm
- starkbank-ecdsa (npm) Vendor— Affected 1.1.2 to before 1.1.3 Fixed in 1.1.3 Patch available GHSA-9wx7-jrvc-28mm
Remediation
- Fix · GHSA-9wx7-jrvc-28mm starkbank-ecdsa (PyPI) Fixed in 2.0.1 Advisory →
- Fix · GHSA-9wx7-jrvc-28mm com.starkbank:ecdsa-java (Maven) Fixed in 1.0.1 Advisory →
- Fix · GHSA-9wx7-jrvc-28mm starkbank-ecdsa (NuGet) Fixed in 1.3.2 Advisory →
- Fix · GHSA-9wx7-jrvc-28mm starkbank-ecdsa (npm) Fixed in 1.1.3 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-9wx7-jrvc-28mm
References
Other 8
- https://github.com/starkbank/ecdsa-python/commit/d136170666e9510eb63c2572551805807bd4c17f
- https://github.com/starkbank/ecdsa-dotnet
- https://github.com/starkbank/ecdsa-java
- https://github.com/starkbank/ecdsa-node
- https://github.com/starkbank/ecdsa-python
- https://github.com/starkbank/ecdsa-python/compare/v2.0.0...v2.0.1
- https://github.com/starkbank/ecdsa-python/releases/tag/v2.0.1
- https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences