CVE catalog

CVE-2022-24884

ecdsautils: CVE-2022-24884

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.04% · Oct 25, 2026

ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature values `r` and `s` are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple signatures from different public keys does not mitigate the issue: `ecdsa_verify_list_legacy()` will accept an arbitrary number of such forged signatures. Both the `ecdsautil verify` CLI command and the libecdsautil library are affected. The issue has been fixed in ecdsautils 0.4.1. All older versions of ecdsautils (including versions before the split into a library and a CLI utility) are vulnerable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianecdsautilssid0.4.2-3fixed
Debianecdsautilsforky0.4.2-3fixed
Debianecdsautilstrixie0.4.2-2fixed
Debianecdsautilsbookworm0.4.1-3fixed
Ubuntuecdsautilspro0.3.2+git20151018-2vulnerable
Ubuntuecdsautilspro0.3.2+git20151018-2build1vulnerable
Ubuntuecdsautilspro0.3.2+git20151018-2ubuntu0.18.04.1~esm1fixed
Ubuntuecdsautils20.040.3.2+git20151018-2build1vulnerable
Ubuntuecdsautils20.040.3.2+git20151018-2+deb10u1build0.20.04.1fixed
Ubuntuecdsautils22.040.3.2+git20151018-2build1vulnerable
Ubuntuecdsautils22.040.3.2+git20151018-2+deb10u1build0.22.04.1fixed
Ubuntuecdsautilspro0.3.2+git20151018-2vulnerable
Ubuntuecdsautilspro0.3.2+git20151018-2build1vulnerable
Ubuntuecdsautilspro0.3.2+git20151018-2ubuntu0.18.04.1~esm1fixed
Ubuntuecdsautils20.040.3.2+git20151018-2build1vulnerable
Ubuntuecdsautils20.040.3.2+git20151018-2+deb10u1build0.20.04.1fixed
Ubuntuecdsautils22.040.3.2+git20151018-2build1vulnerable
Ubuntuecdsautils22.040.3.2+git20151018-2+deb10u1build0.22.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianecdsautilssourcesid0.4.1-1not yet assignedNot reportedNot reported
Debianecdsautilssourceforky0.4.1-1not yet assignedNot reportedNot reported
Debianecdsautilssourcetrixie0.4.1-1not yet assignedNot reportedNot reported
Debianecdsautilssourcebookworm0.4.1-1not yet assignedNot reportedNot reported
Ubuntuecdsautilsdebpro0.3.2+git20151018-2ubuntu0.18.04.1~esm1Not reportedUSN-6239-1Not reported
Ubuntuecdsautilsdeb20.040.3.2+git20151018-2+deb10u1build0.20.04.1Not reportedUSN-6239-1Not reported
Ubuntuecdsautilsdeb22.040.3.2+git20151018-2+deb10u1build0.22.04.1Not reportedUSN-6239-1Not reported
Ubuntuecdsautilsdebpro0.3.2+git20151018-2ubuntu0.18.04.1~esm1Not reportedUBUNTU-CVE-2022-24884Not reported
Ubuntuecdsautilsdeb20.040.3.2+git20151018-2+deb10u1build0.20.04.1Not reportedUBUNTU-CVE-2022-24884Not reported
Ubuntuecdsautilsdeb22.040.3.2+git20151018-2+deb10u1build0.22.04.1Not reportedUBUNTU-CVE-2022-24884Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ecdsautils]Fixed
    Details (2)

    • 0.4.1-3 · amd64 · bookworm

      Fixed · Fixed: 0.4.1-1

      dsa · ecdsautils · debian · bookworm

    • 0.4.1-3 · arm64 · bookworm

      Fixed · Fixed: 0.4.1-1

      dsa · ecdsautils · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]