GHSA-JC66-7Q78-782G Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

Summary forge.pkcs12.pkcs12FromAsn1 accepts a PKCS12 MAC iteration count of zero or less from the input, and the PKCS12 key derivation function then returns a constant key that does not depend on the password or salt. An attacker who does not know the password can modify a PKCS12/PFX file and...

Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

Summary forge.pkcs12.pkcs12FromAsn1 accepts a PKCS12 MAC iteration count of zero or less from the input, and the PKCS12 key derivation function then returns a constant key that does not depend on the password or salt. An attacker who does not know the password can modify a PKCS12/PFX file and...