{"action":"Upgrade com.starkbank.ellipticcurve:starkbank-ecdsa to 1.0.1 or later.","affected":[{"fixed":"1.0.1","introduced":"0"}],"component":"com.starkbank.ellipticcurve:starkbank-ecdsa","cve_ids":["CVE-2021-43570"],"ecosystem":"Maven","epss":0.01027,"exploited":false,"fixed_versions":["1.0.1"],"ghsa_id":"GHSA-r28h-x6hv-2fq3","id":"tcs_01M5N9AN6BPVVTV7TGX689P8C2","modified_at":"2025-01-20T16:50:24.558931Z","published_at":"2021-11-10T20:48:00Z","references":["https://osv.dev/vulnerability/GHSA-r28h-x6hv-2fq3","https://nvd.nist.gov/vuln/detail/CVE-2021-43570","https://github.com/starkbank/ecdsa-java/pull/16","https://github.com/starkbank/ecdsa-java/commit/ed22e484186d6c66d3686bfe39d01bdbabf219b6","https://github.com/starkbank/ecdsa-java","https://github.com/starkbank/ecdsa-java/releases/tag/v1.0.1","https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-r28h-x6hv-2fq3","url":"https://osv.dev/vulnerability/GHSA-r28h-x6hv-2fq3"}],"summary":"Improper Verification of Cryptographic Signature in starkbank-ecdsa"}