Improper Verification Of Signature

node-forge is vulnerable to improper verification of the cryptographic signature. The vulnerability exists due to improper signature verification of tailing garbage bytes in the rsa.js file allowing an attacker to execute a signature forge attack...

@arkecosystem/core (>=3.1.0, <=3.2.0), @arkecosystem/core-forger (>=3.1.0, <=3.2.0) +35 more potentially affected by CVE-2022-24773 via node-forge (>=1.0.0, <=1.2.1)

node-forge NPM version =1.0.0, =3.1.0, =3.1.0, =3.1.0, =1.1.26, =1.0.0-jwt-supply-chain.62c7e930.0, =1.0.0 - @hyperledger/cactus-example-carbon-accounting-backend 1.0.0 - @hyperledger/cactus-example-supply-chain-backend 1.0.0 - @hyperledger/cactus-plugin-htlc-coordinator-besu 1.0.0 -...

Improper Verification of Cryptographic Signature in `node-forge`

Impact RSA PKCS1 v1.5 signature verification code is not properly checking DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. Patches The issue has been addressed in node-forge 1.3.0. For more...

GHSA-2R2C-G63R-VCCR Improper Verification of Cryptographic Signature in `node-forge`

Impact RSA PKCS1 v1.5 signature verification code is not properly checking DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. Patches The issue has been addressed in node-forge 1.3.0. For more...

@arkecosystem/core (>=3.1.0, <=3.2.0), @arkecosystem/core-forger (>=3.1.0, <=3.2.0) +35 more potentially affected by CVE-2022-24772 via node-forge (>=1.0.0, <=1.2.1)

node-forge NPM version =1.0.0, =3.1.0, =3.1.0, =3.1.0, =1.1.26, =1.0.0-jwt-supply-chain.62c7e930.0, =1.0.0 - @hyperledger/cactus-example-carbon-accounting-backend 1.0.0 - @hyperledger/cactus-example-supply-chain-backend 1.0.0 - @hyperledger/cactus-plugin-htlc-coordinator-besu 1.0.0 -...

Improper Verification of Cryptographic Signature in node-forge

Impact RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. Patches The issue has been...

GHSA-X4JG-MJRX-434G Improper Verification of Cryptographic Signature in node-forge

Impact RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. Patches The issue has been...

GHSA-CFM4-QJH2-4765 Improper Verification of Cryptographic Signature in node-forge

Impact RSA PKCS1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS1 encoded message to forge a signature when a low public exponent is being used. Patches The...

@arkecosystem/core (>=3.1.0, <=3.2.0), @arkecosystem/core-forger (>=3.1.0, <=3.2.0) +35 more potentially affected by CVE-2022-24771 via node-forge (>=1.0.0, <=1.2.1)

node-forge NPM version =1.0.0, =3.1.0, =3.1.0, =3.1.0, =1.1.26, =1.0.0-jwt-supply-chain.62c7e930.0, =1.0.0 - @hyperledger/cactus-example-carbon-accounting-backend 1.0.0 - @hyperledger/cactus-example-supply-chain-backend 1.0.0 - @hyperledger/cactus-plugin-htlc-coordinator-besu 1.0.0 -...

Improper Verification of Cryptographic Signature in node-forge

Impact RSA PKCS1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS1 encoded message to forge a signature when a low public exponent is being used. Patches The...

CVE-2022-24772

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed an...

DEBIAN-CVE-2022-24773

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that...

CVE-2022-24773

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that...

DEBIAN-CVE-2022-24772

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed an...

CVE-2022-24771

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses...

DEBIAN-CVE-2022-24771

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses...

UBUNTU-CVE-2022-24772

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed an...

Code injection

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed an...

Code injection

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses...

UBUNTU-CVE-2022-24771

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses...