CVE-2021-43572

The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

• CWE-347

• https://github.com/starkbank/ecdsa-python/commit/d136170666e9510eb63c2572551805807bd4c17fPatch, Third Party Advisory
• https://github.com/starkbank/ecdsa-python/releases/tag/v2.0.1Release Notes, Third Party Advisory
• https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/Exploit, Third Party Advisory
• https://github.com/starkbank/ecdsa-python/commit/d136170666e9510eb63c2572551805807bd4c17fPatch, Third Party Advisory
• https://github.com/starkbank/ecdsa-python/releases/tag/v2.0.1Release Notes, Third Party Advisory
• https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/Exploit, Third Party Advisory

Published

Nov 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43566All versions of Samba prior to 4.13.16 are vulnerable to a m…2.5
• CVE-2021-43568The verify function in the Stark Bank Elixir ECDSA library (…9.8
• CVE-2021-43569The verify function in the Stark Bank .NET ECDSA library (ec…9.8
• CVE-2021-4357The uListing plugin for WordPress is vulnerable to authoriza…5.3
• CVE-2021-43570The verify function in the Stark Bank Java ECDSA library (ec…9.8
• CVE-2021-43571The verify function in the Stark Bank Node.js ECDSA library …9.8
• CVE-2021-43573A buffer overflow was discovered on Realtek RTL8195AM device…9.8
• CVE-2021-43574WebAdmin Control Panel in Atmail 6.5.0 (a version released i…6.1
• CVE-2021-43575KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Pass…5.5
• CVE-2021-43576Jenkins pom2config Plugin 1.2 and earlier does not configure…6.5
• CVE-2021-43577Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does…7.1
• CVE-2021-43578Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 an…8.1