{"action":"Upgrade ecdsa to 0.13.3 or later.","affected":[{"fixed":"0.13.3","introduced":"0"}],"component":"ecdsa","cve_ids":["CVE-2019-14859"],"ecosystem":"PyPI","epss":0.01534,"exploited":false,"fixed_versions":["0.13.3"],"ghsa_id":"GHSA-8qxj-f9rh-9fg2","id":"tcs_01M5KG9NK3SFPJN4Q8T55JZV19","modified_at":"2023-11-08T04:01:11.569013Z","published_at":"2020-01-02T15:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-163","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14859","https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3","https://github.com/warner/python-ecdsa/issues/114","https://pypi.org/project/ecdsa/0.13.3/","https://github.com/advisories/GHSA-8qxj-f9rh-9fg2"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-163","url":"https://osv.dev/vulnerability/PYSEC-2020-163"}],"summary":"A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted,"}