UBUNTU-CVE-2022-24884

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2022-24884
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-24884.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2022-24884
Related
Published
2022-05-06T00:15:00Z
Modified
2025-01-13T10:23:26Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). ecdsa_verify_[prepare_]legacy() does not check whether the signature values r and s are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple signatures from different public keys does not mitigate the issue: ecdsa_verify_list_legacy() will accept an arbitrary number of such forged signatures. Both the ecdsautil verify CLI command and the libecdsautil library are affected. The issue has been fixed in ecdsautils 0.4.1. All older versions of ecdsautils (including versions before the split into a library and a CLI utility) are vulnerable.

References

Affected packages

Ubuntu:Pro:16.04:LTS / ecdsautils

Package

Name
ecdsautils
Purl
pkg:deb/ubuntu/ecdsautils@0.3.2+git20151018-2ubuntu0.16.04.1~esm1?arch=source&distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.3.2+git20151018-2ubuntu0.16.04.1~esm1

Affected versions

0.*

0.3.2+git20151018-2

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "0.3.2+git20151018-2ubuntu0.16.04.1~esm1",
            "binary_name": "ecdsautils"
        },
        {
            "binary_version": "0.3.2+git20151018-2ubuntu0.16.04.1~esm1",
            "binary_name": "ecdsautils-dbgsym"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / ecdsautils

Package

Name
ecdsautils
Purl
pkg:deb/ubuntu/ecdsautils@0.3.2+git20151018-2ubuntu0.18.04.1~esm1?arch=source&distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.3.2+git20151018-2ubuntu0.18.04.1~esm1

Affected versions

0.*

0.3.2+git20151018-2
0.3.2+git20151018-2build1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "0.3.2+git20151018-2ubuntu0.18.04.1~esm1",
            "binary_name": "ecdsautils"
        },
        {
            "binary_version": "0.3.2+git20151018-2ubuntu0.18.04.1~esm1",
            "binary_name": "ecdsautils-dbgsym"
        }
    ]
}

Ubuntu:20.04:LTS / ecdsautils

Package

Name
ecdsautils
Purl
pkg:deb/ubuntu/ecdsautils@0.3.2+git20151018-2+deb10u1build0.20.04.1?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.3.2+git20151018-2+deb10u1build0.20.04.1

Affected versions

0.*

0.3.2+git20151018-2build1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "0.3.2+git20151018-2+deb10u1build0.20.04.1",
            "binary_name": "ecdsautils"
        },
        {
            "binary_version": "0.3.2+git20151018-2+deb10u1build0.20.04.1",
            "binary_name": "ecdsautils-dbgsym"
        }
    ]
}

Ubuntu:22.04:LTS / ecdsautils

Package

Name
ecdsautils
Purl
pkg:deb/ubuntu/ecdsautils@0.3.2+git20151018-2+deb10u1build0.22.04.1?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.3.2+git20151018-2+deb10u1build0.22.04.1

Affected versions

0.*

0.3.2+git20151018-2build1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "0.3.2+git20151018-2+deb10u1build0.22.04.1",
            "binary_name": "ecdsautils"
        },
        {
            "binary_version": "0.3.2+git20151018-2+deb10u1build0.22.04.1",
            "binary_name": "ecdsautils-dbgsym"
        }
    ]
}