DigitalBazaar Forge input validation error vulnerability

Versions of DigitalBazaar Forge prior to 1.4.1 contain a security vulnerability. This vulnerability arises when accepting PKCS12 MACs or PKCS12 encrypted with a password that have zero or fewer encryption iterations; as a result, a fixed key unrelated to both the password and salt is generated...

DigitalBazaar Forge improper exception handling vulnerability

Versions of DigitalBazaar Forge prior to 1.4.1 contain an improper exception handling vulnerability. This vulnerability arises because the TLS client checks for an error attribute when determining whether a server certificate is missing. A malicious TLS server or peer on the path can omit the...

CVE-2022-0122 Open Redirect in digitalbazaar/forge

forge is vulnerable to URL Redirection to Untrusted Site...