Bug 25729 - python-ecdsa new security issues CVE-2019-1485[39]
Summary: python-ecdsa new security issues CVE-2019-1485[39]
Status: NEW
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-11-23 17:23 CET by David Walser
Modified: 2019-11-28 14:57 CET (History)
2 users (show)

See Also:
Source RPM: python-ecdsa-0.13.2-1.mga7.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2019-11-23 17:23:36 CET
Ubuntu has issued an advisory on November 18:
https://usn.ubuntu.com/4196-1/

The issues are fixed upstream in 0.13.3.
Comment 1 David GEIGER 2019-11-23 17:32:36 CET
Done!

CC: (none) => geiger.david68210

Comment 2 David Walser 2019-11-23 17:47:31 CET
Advisory:
========================

Updated python-ecdsa packages fix security vulnerability:

It was discovered that python-ecdsa incorrectly handled certain signatures. A
remote attacker could possibly use this issue to cause python-ecdsa to generate
unexpected exceptions, resulting in a denial of service (CVE-2019-14853).

It was discovered that python-ecdsa incorrectly verified DER encoding in
signatures. A remote attacker could use this issue to perform certain
malleability attacks (CVE-2019-14859).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14853
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14859
https://usn.ubuntu.com/4196-1/
========================

Updated packages in core/updates_testing:
========================
python-ecdsa-0.13.3-1.mga7
python3-ecdsa-0.13.3-1.mga7

from python-ecdsa-0.13.3-1.mga7.src.rpm

Assignee: bugsquad => qa-bugs

Comment 3 Herman Viaene 2019-11-28 14:57:35 CET
MGA7-64 Plasma on Lenovo B50
No installation issues.
No previous updates on these packages.
I have been googling a bit for a simple example for this, but the ones I found involved the installation and usage of other developers stuff for python, so I gave up on those.
If others agree, I will not oppose an OK on clean install.

CC: (none) => herman.viaene


Note You need to log in before you can comment on or make changes to this bug.