Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-ext-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes comparison offsets as length - hash.length - 2, so its two comparison loops jointly...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-jdk16 is a Bouncy Castle Crypto package that is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.6. Affected versions of this package are vulnerable to Improper...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes comparison offsets as length - hash.length - 2, so its two comparison loops jointly...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes comparison offsets as length - hash.length - 2, so its two comparison loops jointly...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes comparison offsets as length - hash.length - 2, so its two comparison loops jointly...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-ext-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path compute...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes comparison offsets as length - hash.length - 2, so its two comparison loops jointly...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes...

DEBIAN-CVE-2022-24773

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that...

DEBIAN-CVE-2022-24772

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed an...

UBUNTU-CVE-2022-24772

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed an...

UBUNTU-CVE-2022-24773

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that...

PT-2022-16869

Name of the Vulnerable Software and Affected Versions node-forge versions prior to 1.3.0 Description The issue concerns the RSA PKCS1 v1.5 signature verification code in node-forge, which does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification wit...