CVE-2021-43572: Improper Verification of Cryptographic Signature (CWE-347)
value: The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 9.8
Published: 2021-11-09T22:15Z
Repository: https://github.com/starkbank/ecdsa-python
Language: Python
Files changed: CHANGELOG.md, ellipticcurve/__init__.py, ellipticcurve/ecdsa.py
Commit date: 2021-11-04 18:07:55 -0300
Commit message: Add signature.r and signature.s range check

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index b8e43d9..22b85ec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,10 +11,12 @@ Given a version number MAJOR.MINOR.PATCH, increment:
 - MINOR version when **backwards compatible changes** are introduced;
 - PATCH version when backwards compatible bug **fixes** are implemented.
 
 
 ## [Unreleased]
+### Fixed
+- Signature r and s range check
 
 ## [2.0.0] - 2021-10-08
 ### Added
 - root imports: from ellipticcurve import PrivateKey, PublicKey, Signature, Ecdsa, File
 ### Changed
diff --git a/ellipticcurve/__init__.py b/ellipticcurve/__init__.py
index 9757fdf..5f4727f 100644
--- a/ellipticcurve/__init__.py
+++ b/ellipticcurve/__init__.py
@@ -1,6 +1,6 @@
-from ellipticcurve.utils.compatibility import *
-from ellipticcurve.privateKey import PrivateKey
-from ellipticcurve.publicKey import PublicKey
-from ellipticcurve.signature import Signature
-from ellipticcurve.utils.file import File
-from ellipticcurve.ecdsa import Ecdsa
+from .utils.compatibility import *
+from .privateKey import PrivateKey
+from .publicKey import PublicKey
+from .signature import Signature
+from .utils.file import File
+from .ecdsa import Ecdsa
diff --git a/ellipticcurve/ecdsa.py b/ellipticcurve/ecdsa.py
index 24e44f7..16c3d9c 100644
--- a/ellipticcurve/ecdsa.py
+++ b/ellipticcurve/ecdsa.py
@@ -31,10 +31,14 @@ class Ecdsa:
         byteMessage = hashfunc(toBytes(message)).digest()
         numberMessage = numberFromByteString(byteMessage)
         curve = publicKey.curve
         r = signature.r
         s = signature.s
+        if not 1 <= r <= curve.N - 1:
+            return False
+        if not 1 <= s <= curve.N - 1:
+            return False
         inv = Math.inv(s, curve.N)
         u1 = Math.multiply(curve.G, n=(numberMessage * inv) % curve.N, N=curve.N, A=curve.A, P=curve.P)
         u2 = Math.multiply(publicKey.point, n=(r * inv) % curve.N, N=curve.N, A=curve.A, P=curve.P)
         add = Math.add(u1, u2, A=curve.A, P=curve.P)
         modX = add.x % curve.N

Vulnerable code: from ellipticcurve.utils.compatibility import *
from ellipticcurve.privateKey import PrivateKey
from ellipticcurve.publicKey import PublicKey
from ellipticcurve.signature import Signature
from ellipticcurve.utils.file import File
from ellipticcurve.ecdsa import Ecdsa
Fixed code: ### Fixed
- Signature r and s range check
from .utils.compatibility import *
from .privateKey import PrivateKey
from .publicKey import PublicKey
from .signature import Signature
from .utils.file import File
from .ecdsa import Ecdsa
        if not 1 <= r <= curve.N - 1:
            return False
        if not 1 <= s <= curve.N - 1:
            return False