CVE-2019-14859

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
Red Hat	python-ecdsa	all python-ecdsa versions before 0.13.3

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14859Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/warner/python-ecdsa/issues/114Exploit, Third Party Advisory
https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3Release Notes, Third Party Advisory
https://pypi.org/project/ecdsa/0.13.3/Release Notes, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14859Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/warner/python-ecdsa/issues/114Exploit, Third Party Advisory
https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3Release Notes, Third Party Advisory
https://pypi.org/project/ecdsa/0.13.3/Release Notes, Third Party Advisory

Timeline

Published: Jan 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-14866.1A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL CVE-2019-148606.5It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack CVE-2019-148615.3All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC CVE-2019-148626.1There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application CVE-2019-148636.1There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web appli CVE-2019-148646.5Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it CVE-2019-148655.9A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by CVE-2019-148667.3In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR arc CVE-2019-148678.8A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way th CVE-2019-148687.8In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override CVE-2019-148698.8A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privi CVE-2019-14876.5An information disclosure vulnerability in Android Apps using Microsoft Authentication Library (MSAL) 0.3.1-Alpha or later exists under spec