MediumGHSA-2r2c-g63r-vccrCVE-2022-24773
Improper Verification of Cryptographic Signature in `node-forge`
Published 18 Mar 2022 · Updated 8 Nov 2023
Affected package
node-forgenpm
- Affected
- <1.3.0
- Fixed in
- 1.3.0
Update to the fixed version for your release line, for example:
npm install node-forge@1.3.0Details
Impact
RSA PKCS#1 v1.5 signature verification code is not properly checking DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.
Patches
The issue has been addressed in node-forge 1.3.0.
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge
- Email us at [example email address](mailto:security@digitalbazaar.com)
Is GHSA-2r2c-g63r-vccr in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected node-forge, and gives you the command that fixes it.
References
- Linkgithub.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr
- Advisorynvd.nist.gov/vuln/detail/CVE-2022-24773
- Linkgithub.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1
- Linkgithub.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2
- Packagegithub.com/digitalbazaar/forge
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.