All the vulnerabilites related to digitalbazaar - forge
cve-2020-7720
Vulnerability from cvelistv5
Published
2020-09-01 09:35
Modified
2024-09-16 17:49
Severity ?
EPSS score ?
Summary
Prototype Pollution
References
▼ | URL | Tags |
---|---|---|
https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677 | x_refsource_MISC | |
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293 | x_refsource_MISC | |
https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md | x_refsource_CONFIRM |
Impacted products
▼ | Vendor | Product |
---|---|---|
n/a | node-forge |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T09:41:00.856Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "node-forge", "vendor": "n/a", "versions": [ { "lessThan": "unspecified", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "NerdJS" } ], "datePublic": "2020-09-01T00:00:00", "descriptions": [ { "lang": "en", "value": "The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "exploitCodeMaturity": "PROOF_OF_CONCEPT", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "description": "Prototype Pollution", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-09-02T19:13:19", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677" }, { "tags": [ "x_refsource_MISC" ], "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md" } ], "title": "Prototype Pollution", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "report@snyk.io", "DATE_PUBLIC": "2020-09-01T09:30:33.465829Z", "ID": "CVE-2020-7720", "STATE": "PUBLIC", "TITLE": "Prototype Pollution" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "node-forge", "version": { "version_data": [ { "version_affected": "\u003e=", "version_value": "0" } ] } } ] }, "vendor_name": "n/a" } ] } }, "credit": [ { "lang": "eng", "value": "NerdJS" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Prototype Pollution" } ] } ] }, "references": { "reference_data": [ { "name": "https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677" }, { "name": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293" }, { "name": "https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md", "refsource": "CONFIRM", "url": "https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md" } ] } } } }, "cveMetadata": { "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2020-7720", "datePublished": "2020-09-01T09:35:12.869324Z", "dateReserved": "2020-01-21T00:00:00", "dateUpdated": "2024-09-16T17:49:31.304Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2022-24772
Vulnerability from cvelistv5
Published
2022-03-18 13:30
Modified
2024-08-03 04:20
Severity ?
EPSS score ?
Summary
Improper Verification of Cryptographic Signature in `node-forge`
References
Impacted products
▼ | Vendor | Product |
---|---|---|
digitalbazaar | forge |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T04:20:50.492Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "forge", "vendor": "digitalbazaar", "versions": [ { "status": "affected", "version": "\u003c 1.3.0" } ] } ], "descriptions": [ { "lang": "en", "value": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-03-18T13:30:20", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g" } ], "source": { "advisory": "GHSA-x4jg-mjrx-434g", "discovery": "UNKNOWN" }, "title": "Improper Verification of Cryptographic Signature in `node-forge`", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24772", "STATE": "PUBLIC", "TITLE": "Improper Verification of Cryptographic Signature in `node-forge`" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "forge", "version": { "version_data": [ { "version_value": "\u003c 1.3.0" } ] } } ] }, "vendor_name": "digitalbazaar" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-347: Improper Verification of Cryptographic Signature" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1", "refsource": "MISC", "url": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1" }, { "name": "https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2", "refsource": "MISC", "url": "https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2" }, { "name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g", "refsource": "CONFIRM", "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g" } ] }, "source": { "advisory": "GHSA-x4jg-mjrx-434g", "discovery": "UNKNOWN" } } } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24772", "datePublished": "2022-03-18T13:30:20", "dateReserved": "2022-02-10T00:00:00", "dateUpdated": "2024-08-03T04:20:50.492Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2022-24771
Vulnerability from cvelistv5
Published
2022-03-18 13:25
Modified
2024-08-03 04:20
Severity ?
EPSS score ?
Summary
Improper Verification of Cryptographic Signature in node-forge
References
▼ | URL | Tags |
---|---|---|
https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765 | x_refsource_CONFIRM | |
https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1 | x_refsource_MISC |
Impacted products
▼ | Vendor | Product |
---|---|---|
digitalbazaar | forge |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T04:20:50.502Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "forge", "vendor": "digitalbazaar", "versions": [ { "status": "affected", "version": "\u003c 1.3.0" } ] } ], "descriptions": [ { "lang": "en", "value": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-03-18T13:25:11", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1" } ], "source": { "advisory": "GHSA-cfm4-qjh2-4765", "discovery": "UNKNOWN" }, "title": "Improper Verification of Cryptographic Signature in node-forge", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24771", "STATE": "PUBLIC", "TITLE": "Improper Verification of Cryptographic Signature in node-forge" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "forge", "version": { "version_data": [ { "version_value": "\u003c 1.3.0" } ] } } ] }, "vendor_name": "digitalbazaar" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-347: Improper Verification of Cryptographic Signature" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765", "refsource": "CONFIRM", "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765" }, { "name": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1", "refsource": "MISC", "url": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1" } ] }, "source": { "advisory": "GHSA-cfm4-qjh2-4765", "discovery": "UNKNOWN" } } } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24771", "datePublished": "2022-03-18T13:25:11", "dateReserved": "2022-02-10T00:00:00", "dateUpdated": "2024-08-03T04:20:50.502Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2022-0122
Vulnerability from cvelistv5
Published
2022-01-06 05:00
Modified
2024-08-02 23:18
Severity ?
EPSS score ?
Summary
Open Redirect in digitalbazaar/forge
References
▼ | URL | Tags |
---|---|---|
https://huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae | x_refsource_CONFIRM | |
https://github.com/digitalbazaar/forge/commit/db8016c805371e72b06d8e2edfe0ace0df934a5e | x_refsource_MISC |
Impacted products
▼ | Vendor | Product |
---|---|---|
digitalbazaar | digitalbazaar/forge |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T23:18:41.696Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/digitalbazaar/forge/commit/db8016c805371e72b06d8e2edfe0ace0df934a5e" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "digitalbazaar/forge", "vendor": "digitalbazaar", "versions": [ { "lessThan": "1.0.0", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "forge is vulnerable to URL Redirection to Untrusted Site" } ], "metrics": [ { "cvssV3_0": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-01-06T05:00:11", "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/digitalbazaar/forge/commit/db8016c805371e72b06d8e2edfe0ace0df934a5e" } ], "source": { "advisory": "41852c50-3c6d-4703-8c55-4db27164a4ae", "discovery": "EXTERNAL" }, "title": "Open Redirect in digitalbazaar/forge", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@huntr.dev", "ID": "CVE-2022-0122", "STATE": "PUBLIC", "TITLE": "Open Redirect in digitalbazaar/forge" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "digitalbazaar/forge", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "1.0.0" } ] } } ] }, "vendor_name": "digitalbazaar" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "forge is vulnerable to URL Redirection to Untrusted Site" } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-601 URL Redirection to Untrusted Site" } ] } ] }, "references": { "reference_data": [ { "name": "https://huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae", "refsource": "CONFIRM", "url": "https://huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae" }, { "name": "https://github.com/digitalbazaar/forge/commit/db8016c805371e72b06d8e2edfe0ace0df934a5e", "refsource": "MISC", "url": "https://github.com/digitalbazaar/forge/commit/db8016c805371e72b06d8e2edfe0ace0df934a5e" } ] }, "source": { "advisory": "41852c50-3c6d-4703-8c55-4db27164a4ae", "discovery": "EXTERNAL" } } } }, "cveMetadata": { "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntrdev", "cveId": "CVE-2022-0122", "datePublished": "2022-01-06T05:00:12", "dateReserved": "2022-01-05T00:00:00", "dateUpdated": "2024-08-02T23:18:41.696Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2022-24773
Vulnerability from cvelistv5
Published
2022-03-18 13:30
Modified
2024-08-03 04:20
Severity ?
EPSS score ?
Summary
Improper Verification of Cryptographic Signature in `node-forge`
References
Impacted products
▼ | Vendor | Product |
---|---|---|
digitalbazaar | forge |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T04:20:50.554Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "forge", "vendor": "digitalbazaar", "versions": [ { "status": "affected", "version": "\u003c 1.3.0" } ] } ], "descriptions": [ { "lang": "en", "value": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-03-18T13:30:14", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2" } ], "source": { "advisory": "GHSA-2r2c-g63r-vccr", "discovery": "UNKNOWN" }, "title": "Improper Verification of Cryptographic Signature in `node-forge`", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24773", "STATE": "PUBLIC", "TITLE": "Improper Verification of Cryptographic Signature in `node-forge`" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "forge", "version": { "version_data": [ { "version_value": "\u003c 1.3.0" } ] } } ] }, "vendor_name": "digitalbazaar" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-347: Improper Verification of Cryptographic Signature" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1", "refsource": "MISC", "url": "https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1" }, { "name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr", "refsource": "CONFIRM", "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr" }, { "name": "https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2", "refsource": "MISC", "url": "https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2" } ] }, "source": { "advisory": "GHSA-2r2c-g63r-vccr", "discovery": "UNKNOWN" } } } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24773", "datePublished": "2022-03-18T13:30:14", "dateReserved": "2022-02-10T00:00:00", "dateUpdated": "2024-08-03T04:20:50.554Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }