It was discovered that ecdsautils, a collection of ECDSA elliptic curve cryptography CLI tools verified some cryptographic signatures incorrectly:
A signature consisting only of zeroes was always considered valid,
making it trivial to forge signatures.
For the oldstable distribution (buster), this problem has been fixed
in version 0.3.2+git20151018-2+deb10u1.
For the stable distribution (bullseye), this problem has been fixed in
We recommend that you upgrade your ecdsautils packages.