CVE-2021-43569

Summary

CVE	CVE-2021-43569
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-11-09 22:15:00 UTC
Updated	2021-11-12 20:01:00 UTC
Description	The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

Risk And Classification

Problem Types: CWE-347

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Starkbank	Ecdsa-dotnet	1.3.2	All	All	All

References

Reference	Source	Link	Tags
Technical Advisory – Arbitrary Signature Forgery in Stark Bank ECDSA Libraries (CVE-2021-43572, CVE-2021-43570, CVE-2021-43569, CVE-2021-43568, CVE-2021-43571) – NCC Group Research	MISC	research.nccgroup.com
Release v1.3.2 · starkbank/ecdsa-dotnet · GitHub	MISC	github.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

980156 Dotnet (nuget) Security Update for starkbank-ecdsa (GHSA-j3jw-j2j8-2wv9)