sm-crypto Signature Malleability Vulnerability in SM2 Verification Logic

A signature malleability vulnerability has been identified in the SM2 signature verification logic of the sm-crypto library, in versions prior to 0.3.14. This vulnerability allows an attacker to derive a new valid signature for a previously signed message, exploiting the way signatures are verified.

Impact

Exploitation of this vulnerability allows for signature malleability, where an attacker can create a new valid signature for a message that has already been signed, potentially leading to unauthorized actions or validations based on the forged signature.

Remediation

Users can upgrade to sm-crypto version 0.3.14 or later to address this vulnerability.