Improper Verification of Cryptographic Signature in `node-forge` (GHSA-2r2c-g63r-vccr)

Description

RSA PKCS#1 v1.5 signature verification code is not properly checking DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.0
• Patched version(s): 1.3.0

References

• GHSA-2r2c-g63r-vccr
• CVE-2022-24773
• CWE-347
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• Prototype Pollution in node-forge - CVE-2020-7720
• Improper Verification of Cryptographic Signature in node-forge (GHSA-cfm4-qjh2-4765) - CVE-2022-24771
• Nuxt vulnerable to remote code execution via the browser when running the test locally - CVE-2024-34344
• Open Redirect in node-forge - CVE-2022-0122

Tags:

npm

node-forge