WS-2020-0048

The ""verifyVerifiableCredential"" https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-credential-signer.tsL57 method check the cryptographic integrity of the Verifiable Credential, but it does not check if the ""credential.issuer""...

WS-2020-0046

The ""verifyVerifiablePresentation"" https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-presentation-signer.tsL97 method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the ""credentialSubject.id""...

Credentials Verification Bypass

vp-toolkit is vulnerable to credentials verification bypass. The verifyVerifiablePresentation function verifies the cryptographic integrity of the Verifiable Presentation but failure to check if the credentialSubject.id matches the signer of the VP proof allows to bypass the verification...

ula-vp-controller (0.1.0) potentially affected by unknown CVE via vp-toolkit (0.1.1)

vp-toolkit NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on vp-toolkit and may be impacted: - ula-vp-controller 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-P94W-42G3-F7H4...

ula-vp-controller (0.1.0) potentially affected by unknown CVE via vp-toolkit (0.1.1)

vp-toolkit NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on vp-toolkit and may be impacted: - ula-vp-controller 0.1.0 Source cves: unknown CVE Source advisory: GHSA-P94W-42G3-F7H4...

ula-vp-controller (0.1.0) potentially affected by unknown CVE via vp-toolkit (0.1.1)

vp-toolkit NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on vp-toolkit and may be impacted: - ula-vp-controller 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-FF5X-W9WG-H275...

ula-vp-controller (0.1.0) potentially affected by unknown CVE via vp-toolkit (0.1.1)

vp-toolkit NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on vp-toolkit and may be impacted: - ula-vp-controller 0.1.0 Source cves: unknown CVE Source advisory: GHSA-FF5X-W9WG-H275...

PT-2020-21433

Name of the Vulnerable Software and Affected Versions vp-toolkit versions prior to 0.2.2 Description The verifyVerifiableCredential method does not check if the credential.issuer DID matches the signer of the credential, which impacts the verifier. Recommendations For versions prior to 0.2.2,...

PT-2020-21272

Name of the Vulnerable Software and Affected Versions vp-toolkit versions prior to 0.2.2 Description The verifyVerifiablePresentation method does not check if the credentialSubject.id DID matches the signer of the VP proof, impacting the verifier. Recommendations For versions prior to 0.2.2, as a...