[GHSA-9wx7-jrvc-28mm] Signature verification vulnerability in Stark Bank ecdsa libraries

[RainSignal]

Updates

• Affected products

Comments
The advisory only lists ecdsa-java as an affected package, but the
vulnerability affects all four Stark Bank ECDSA implementations. We
verified each implementation by reviewing the source code:

1. Python (starkbank-ecdsa on pip)
   Fixed in v2.0.1. Verified via diff:
   starkbank/ecdsa-python@v2.0.0...v2.0.1
   The fix adds range checks for r and s in ellipticcurve/ecdsa.py:
   if not 1 <= r <= curve.N - 1: return False
   if not 1 <= s <= curve.N - 1: return False

2. Java (com.starkbank:ecdsa-java on Maven)
   Fixed in v1.0.1. Verified by reviewing:
   https://github.com/starkbank/ecdsa-java/blob/v1.0.1/src/main/java/com/starkbank/ellipticcurve/Ecdsa.java
   The fix adds equivalent range checks in Ecdsa.verify().

3. .NET (starkbank-ecdsa on NuGet)
   Fixed in v1.3.2. Verified by comparing:
   https://github.com/starkbank/ecdsa-dotnet/blob/v1.3.1/EcdsaDotNet/EcdsaDotNet/ecdsa.cs (vulnerable)
   https://github.com/starkbank/ecdsa-dotnet/blob/v1.3.2/EcdsaDotNet/EcdsaDotNet/ecdsa.cs (fixed)
   v1.3.1 has no range checks; v1.3.2 adds:
   if (sigR < 1 || sigR >= curve.N) return false;
   if (sigS < 1 || sigS >= curve.N) return false;
   Earliest affected version confirmed as v1.0.0.

4. Node.js (starkbank-ecdsa on npm)
   Fixed in v1.1.3. Verified by comparing:
   https://github.com/starkbank/ecdsa-node/blob/v1.1.2/ellipticcurve/ecdsa.js (vulnerable)
   https://github.com/starkbank/ecdsa-node/blob/v1.1.3/ellipticcurve/ecdsa.js (fixed)
   v1.1.2 has no range checks; v1.1.3 adds equivalent checks.
   The ecdsa.js component did not exist in v0.0.3, so the earliest
   affected version is v1.0.0.

All four implementations share the same root cause: the verify()
function does not validate that signature parameters r and s are
within the valid range [1, N-1], allowing an attacker to forge
signatures that pass verification for any public key.

[JonathanLEvans]

Hi @RainSignal

The advisory already has all four listed. Could you clarify what you are asking us to change?