browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack

Description

An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack.

Recommendation

Update the browserify-sign package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.6.0, <= 4.2.1
• Patched version(s): 4.2.2

References

• GHSA-x9w5-v3q2-3rhw
• lists.debian.org
• lists.fedoraproject.org
• www.debian.org
• CVE-2023-46234
• CWE-347
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• Elliptic's EDDSA missing signature length check - CVE-2024-42459
• XSS Attack with Express API - CVE-2023-23630
• Server-Side Request Forgery (SSRF) in vriteio/vrite - CVE-2023-5572
• Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client - CVE-2023-41049

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

browserify-sign