Improper Verification of Cryptographic Signature in node-forge

Description

RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.0
• Patched version(s): 1.3.0

References

• GHSA-x4jg-mjrx-434g
• CVE-2022-24772
• CWE-347
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• Prototype Pollution in node-forge - CVE-2020-7720
• Remote Code Execution on click of <a> Link in markdown preview - CVE-2024-49362
• XSS vulnerability that affects bootstrap (GHSA-3mgp-fx93-9xv5) - CVE-2018-20676
• follow-redirects' Proxy-Authorization header kept across hosts - CVE-2024-28849

Tags:

npm

node-forge