PyPI/fastecdsa CVE-2024-21502: unknown, EPSS 1.03%
Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as use
Action: Upgrade fastecdsa to 2.3.2 or later.
pip install fastecdsa==2.3.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.3.2 | - |
Fixed versions
| 2.3.2 |
Sources
- osv: PYSEC-2024-39
- https://security.snyk.io/vuln/SNYK-PYTHON-FASTECDSA-6262045
- https://gist.github.com/keltecc/49da037072276f21b005a8337c15db26
- https://github.com/AntonKueltz/fastecdsa/blob/v2.3.1/src/curveMath.c%23L210
- https://github.com/AntonKueltz/fastecdsa/commit/57fc5689c95d649dab7ef60cc99ac64589f01e36
- https://github.com/advisories/GHSA-ph86-g9r3-5qw4
CVE-2024-21502 · published · modified · JSON