Skip to content
Fencer Vulns
high 7.4

CVE-2024-23342 json

python-ecdsa vulnerable to Minerva attack on P-256

published 2024-01-22 2 y ago modified 2026-09-10 1 mo ago also GHSA-wj6h-64fc-37mp , PYSEC-2026-1325 , EUVD-2024-0448

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.

Patch / fix

  • rubygem-rack satellite capsule 6.15, satellite 6.15 2.2.8.1-1.el8sat
  • python-pulp-container satellite capsule 6.15, satellite 6.15 2.16.9-2.el8pc
  • rubygem-activestorage satellite 6.15 6.1.7.7-1.el8sat
  • python3.11-pulp-container satellite capsule 6.15, satellite 6.15 2.16.9-2.el8pc
  • python-ecdsa rhui 4 0.18.0-4.el8ui
  • python-django rhui 4 4.2.11-1.el8ui
  • python-jinja2 rhui 4 3.1.3-1.el8ui
  • python-aiohttp rhui 4 3.9.2-1.el8ui

red hat advisories RHSA-2024:10806RHSA-2024:1878

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-23342 updated cvss 7.4

python-ecdsa: vulnerable to the Minerva attack

  • Red Hat Satellite 6 python-ecdsa, python3-ecdsa
    affected: workaround, no fix available
  • Red Hat Satellite 6.15 for RHEL 8 python-pulp-container 2.16.9-2.el8pc, python3.11-pulp-container 2.16.9-2.el8pc
    fixed: vendor fix RHSA-2024:10806
  • Red Hat RHUI 4 for RHEL 8 python-ecdsa 0.18.0-4.el8ui, python3.11-ecdsa 0.18.0-4.el8ui
    fixed: vendor fix RHSA-2024:1878
  • Red Hat Ansible Automation Platform 2 python-ecdsa Red Hat Satellite 6.15 for RHEL 8 foreman 3.9.1.12-1.el8sat, satellite 6.15.5-1.el8sat, puppetserver 7.17.2-1.el8sat, foreman-cli 3.9.1.12-1.el8sat, foreman-ec2 3.9.1.12-1.el8sat, foreman-pcp 3.9.1.12-1.el8sat, +35 more Red Hat RHUI 4 for RHEL 8 libsolv 0.7.22-6.el8ui, libcomps 0.1.18-8.el8ui, python-jq 1.6.0-3.el8ui, python-xlrd 2.0.1-8.el8ui, python-xlwt 1.3.0-6.el8ui, python-yarl 1.8.2-4.el8ui, +201 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
OSV 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi ecdsa
all versions
 no fix listed

Affected products

  • tlsfuzzer python-ecdsa

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.