{"action":"Upgrade starkbank-ecdsa to 2.0.1 or later.","affected":[{"fixed":"2.0.1","introduced":"0"}],"component":"starkbank-ecdsa","cve_ids":["CVE-2021-43572"],"ecosystem":"PyPI","epss":0.01248,"exploited":false,"fixed_versions":["2.0.1"],"ghsa_id":"GHSA-92vm-mxjf-jqf3","id":"tcs_01M5KGCZRXEFW3RXXDQS5BS62R","modified_at":"2023-11-08T04:07:10.830168Z","published_at":"2021-11-09T22:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-426","https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/","https://github.com/starkbank/ecdsa-python/releases/tag/v2.0.1","https://github.com/advisories/GHSA-92vm-mxjf-jqf3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-426","url":"https://osv.dev/vulnerability/PYSEC-2021-426"}],"summary":"The verify function in the Stark Bank Python ECDSA library (ecdsa-python) 2.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages."}