8 matches found
DigitalBazaar Forge input validation error vulnerability
Versions of DigitalBazaar Forge prior to 1.4.1 contain a security vulnerability. This vulnerability arises when accepting PKCS12 MACs or PKCS12 encrypted with a password that have zero or fewer encryption iterations; as a result, a fixed key unrelated to both the password and salt is generated...
DigitalBazaar Forge improper exception handling vulnerability
Versions of DigitalBazaar Forge prior to 1.4.1 contain an improper exception handling vulnerability. This vulnerability arises because the TLS client checks for an error attribute when determining whether a server certificate is missing. A malicious TLS server or peer on the path can omit the...
DigitalBazaar Forge input validation error vulnerability
Versions of DigitalBazaar Forge prior to 1.4.1 contain a security vulnerability. This vulnerability arises because, under CBC and ECB encryption modes, only the last byte of PKCS7 padding is verified; zero, excessively large, or mismatched padding bytes are accepted. As a result, malformed...
DigitalBazaar Forge encryption issue vulnerability
Versions of DigitalBazaar Forge prior to 1.4.1 contain an encryption-related vulnerability. This vulnerability arises because in the processing of certificate.verifychild, verifySignature, and lib/x509.js, RSA padding and RSASSA-PSS parameters are selected from the issuer’s certificate rather tha...
DigitalBazaar Forge resource management error vulnerability
Versions of DigitalBazaar Forge prior to 1.4.1 contain a resource management error vulnerability. This vulnerability arises because pem.decode uses polynomial-time regular expressions to process PEM input when an END line is missing. Unauthenticated attackers can exploit this by sending long...
DigitalBazaar Forge encryption issue vulnerability
Versions prior to digitalbazaar forge 1.4.1 contain a security vulnerability. This vulnerability arises because pki.verifyCertificateChain modifies the CA store when validating certificates with shared subject names. A failed validation may result in the permanent removal of trusted CA...
DigitalBazaar Forge input validation error vulnerability
Versions prior to 1.4.1 of digitalbazaar forge contain an input validation error vulnerability. This vulnerability arises because the forge.http client stores the cookie name and path from the Set-Cookie response header within a regular JavaScript object. A malicious server can exploit special...
