id: PYSEC-2024-39
modified: 2024-02-24T07:19:09.418536Z
published: 2024-02-24T05:15:00Z
aliases:
- CVE-2024-21502
- GHSA-ph86-g9r3-5qw4
details: Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized
  Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to
  being used and interpreted as user-defined type. Depending on the variable's actual
  value it could be arbitrary free(), arbitrary realloc(), null pointer dereference
  and other. Since the stack can be controlled by the attacker, the vulnerability
  could be used to corrupt allocator structure, leading to possible heap exploitation.
  The attacker could cause denial of service by exploiting this vulnerability.
affected:
- package:
    ecosystem: PyPI
    name: fastecdsa
    purl: pkg:pypi/fastecdsa
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 57fc5689c95d649dab7ef60cc99ac64589f01e36
    repo: https://github.com/AntonKueltz/fastecdsa
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.3.2
  versions:
  - 1.0.0b1
  - 1.0.1
  - 1.0.1b1
  - 1.0.1b2
  - 1.0.1b3
  - 1.0.2
  - 1.0.3
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.2.1
  - 1.3.1
  - 1.3.2
  - 1.4.1
  - 1.4.2
  - 1.4.3
  - 1.5.1
  - 1.5.2
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - 1.6.5
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - 1.7.5
  - 2.0.0
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.1.5
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.1
references:
- type: WEB
  url: https://security.snyk.io/vuln/SNYK-PYTHON-FASTECDSA-6262045
- type: WEB
  url: https://gist.github.com/keltecc/49da037072276f21b005a8337c15db26
- type: WEB
  url: https://github.com/AntonKueltz/fastecdsa/blob/v2.3.1/src/curveMath.c%23L210
- type: FIX
  url: 
    https://github.com/AntonKueltz/fastecdsa/commit/57fc5689c95d649dab7ef60cc99ac64589f01e36
- type: ADVISORY
  url: https://github.com/advisories/GHSA-ph86-g9r3-5qw4