ECDSA Signature Verification Flaw in Crypt::Perl by FGasper

CVE-2020-13895

Summary

The Crypt::Perl module (p5-Crypt-Perl) prior to version 0.32 suffers from an issue in the Crypt::Perl::ECDSA function, where it fails to properly verify ECDSA signatures under specific conditions. This vulnerability arises when the r and s values are small, particularly when s equals 1, while utilizing the secp256r1 (also known as prime256v1) curve. An attacker can exploit this flaw by manipulating public r and s values to potentially guess the outcome of signature verifications, potentially compromising the integrity of cryptographic operations.

References