GHSA-9wx7-jrvc-28mm
Signature verification vulnerability in Stark Bank ecdsa libraries
GHSA-9wx7-jrvc-28mm is a vulnerability with no CVSS score yet in starkbank-ecdsa, published November 8, 2021. No source lists public exploit code. Fixed in starkbank-ecdsa 2.0.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.1starkbank-ecdsa +7 more
Description
An attacker can forge signatures on arbitrary messages that will verify for any public key. This may allow attackers to authenticate as any user within the Stark Bank platform, and bypass signature verification needed to perform operations on the platform, such as send payments and transfer funds. Additionally, the ability for attackers to forge signatures may impact other users and projects using these libraries in different and unforeseen ways.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
starkbank-ecdsaPyPI | before 2.0.1 | 2.0.1 |
com.starkbank:ecdsa-javaMaven | 1.0.0 to 1.0.0 | 1.0.1 |
starkbank-ecdsaNuGet | 1.3.1 to 1.3.1 | 1.3.2 |
starkbank-ecdsanpm | 1.1.2 to 1.1.2 | 1.1.3 |
starkbank-ecdsaPyPI | before 2.0.1, plus listed versions 0.10.1.10.1.20.1.30.1.4 Show 9 moreShow less0.1.50.1.60.1.70.1.80.1.91.0.01.1.01.1.12.0.0 | 2.0.1 |
com.starkbank:ecdsa-javaMaven | 1.0.0 up to 1.0.1 | 1.0.1 |
starkbank-ecdsaNuGet | 1.3.1 up to 1.3.2 | 1.3.2 |
starkbank-ecdsanpm | 1.1.2 up to 1.1.3 | 1.1.3 |
What each source reports
GitHub AdvisoriesNo score
Signature verification vulnerability in Stark Bank ecdsa libraries
An attacker can forge signatures on arbitrary messages that will verify for any public key. This may allow attackers to authenticate as any user within the Stark Bank platform, and bypass signature verification needed to perform operations on the platform, such as send payments and transfer funds. Additionally, the ability for attackers to forge signatures may impact other users and projects using these libraries in different and unforeseen ways.
- Record
GHSA-9wx7-jrvc-28mm- Weakness
- CWE-347
- Updated
- 2026-11-02
OSVNo score
Signature verification vulnerability in Stark Bank ecdsa libraries
An attacker can forge signatures on arbitrary messages that will verify for any public key. This may allow attackers to authenticate as any user within the Stark Bank platform, and bypass signature verification needed to perform operations on the platform, such as send payments and transfer funds. Additionally, the ability for attackers to forge signatures may impact other users and projects using these libraries in different and unforeseen ways.
- Record
GHSA-9wx7-jrvc-28mm- Weakness
- CWE-347
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/starkbank/ecdsa-python/releases/tag/v2.0.1
research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries