- Reported
-
- Issued
-
- Package
-
bsv-rs
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#bitcoin
#ecdsa
#der
#signature
#malleability
#parsing
- Aliases
-
- References
-
- CVSS Score
- 5.3
MEDIUM
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality Impact
- None
- Integrity Impact
- Low
- Availability Impact
- None
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Patched
-
>=0.8.6, <0.9.0-beta.1>0.9.0-beta.7
- Affected Functions
- Version
bsv_rs::auth::Certificate::verify-
bsv_rs::auth::VerifiableCertificate::verify-
bsv_rs::auth::utils::validate_certificate_encoding-
<0.8.6>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::compat::bsm::verify_message_der-
<0.8.6>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::kvstore::KVStoreInterpreter::verify_signature-
<0.8.6>=0.9.0-beta.1, <=0.9.0-beta.2
bsv_rs::messages::verify-
<0.8.6>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::primitives::bsv::TransactionSignature::from_checksig_format-
<0.8.6>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::primitives::ec::Signature::from_der-
<0.8.6>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::wallet::ProtoWallet::verify_signature-
<0.8.6>=0.9.0-beta.1, <=0.9.0-beta.2
Description
Signature::from_der read a DER-encoded ECDSA signature leniently. It read as
the signature: the signature followed by other bytes; a sequence length
shorter than its contents, or longer with bytes after them (a length byte with
its high bit set among them); and an R or S preceded by a zero byte it did not
need. It read a lone-zero R or S as zero.
messages::verify, compat::bsm::verify_message_der,
auth::Certificate::verify, auth::VerifiableCertificate::verify,
wallet::ProtoWallet::verify_signature and
kvstore::KVStoreInterpreter::verify_signature read through it, and each
verified such a form of a valid signature. Given one signature a key holder
made, anyone could produce other byte strings that verify as that signature
over the same data. No form verifies over other data: an application that acts
on the verdict alone is not affected; one that compares, hashes or stores a
signature's bytes is.
0.8.6 refuses each form as Error::InvalidSignature. A signature's bytes are
still not unique after the patch: the same signature with S replaced by n - S
verifies, so an application that keys on the bytes also requires
Signature::is_low_s().
Advisory available under CC0-1.0
license.