| Package | Affected versions | Patched versions |
|---|---|---|
| com.starkbank.ellipticcurve:starkbank-ecdsa | < 1.0.1 | 1.0.1 |
| ecdsa-java | = 1.0.0 |
The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free