Vulnerabilities

 1 via 1 paths

Dependencies

 72

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: net.i2p.crypto:eddsa
  • Introduced through: net.i2p.crypto:eddsa@0.3.0

Detailed paths

  • Introduced through: miguelaferreira/devex-cli@miguelaferreira/devex-cli › net.i2p.crypto:eddsa@0.3.0

Overview

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the x_engineVerify() method in EdDSAEngine.java, which does not comply with RFC 8032 specifications for signature maleability. An attacker can create new valid signatures different from previous signatures for a known message.

Remediation

There is no fixed version for net.i2p.crypto:eddsa.

References

Improper Verification of Cryptographic Signature vulnerability report