VULNERABILITY INTELLIGENCE
CVE-2024-23342
CVSS score7.4 HIGH
EPSS probability0.98%
CISA KEVNot currently listed
Published2024-01-23
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.
Weakness classification
- security-advisories@github.com: CWE-203
Primary references
- security-advisories@github.com — Product
- security-advisories@github.com — Exploit, Vendor Advisory
- security-advisories@github.com — Technical Description
- security-advisories@github.com — Technical Description
- af854a3a-2127-422b-91ae-364da2661108 — Product
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Technical Description
- af854a3a-2127-422b-91ae-364da2661108 — Technical Description