DEBIAN-CVE-2022-24884

    Dashboard / Vulnerabilities / DEBIAN-CVE-2022-24884

    DEBIAN-CVE-2022-24884

    Published: 6 May 2022Last Modified: 1 Sept 2026
    Upstream:
    CVE-2022-24884

    Summary:

    Details: ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature values `r` and `s` are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple signatures from different public keys does not mitigate the issue: `ecdsa_verify_list_legacy()` will accept an arbitrary number of such forged signatures. Both the `ecdsautil verify` CLI command and the libecdsautil library are affected. The issue has been fixed in ecdsautils 0.4.1. All older versions of ecdsautils (including versions before the split into a library and a CLI utility) are vulnerable.

    References: https://security-tracker.debian.org/tracker/CVE-2022-24884

    Affected packages

    Package

    Name: ecdsautils

    Purl: pkg:deb/debian/ecdsautils?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.4.1-1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2022-24884 | CVE-DB