Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
References
| Link | Resource |
|---|---|
| https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1 | Patch Third Party Advisory |
| https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2 | Patch Third Party Advisory |
| https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g | Third Party Advisory |
| https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1 | Patch Third Party Advisory |
| https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2 | Patch Third Party Advisory |
| https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g | Third Party Advisory |
Configurations
History
21 Nov 2024, 06:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1 - Patch, Third Party Advisory | |
| References | () https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2 - Patch, Third Party Advisory | |
| References | () https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g - Third Party Advisory |
Information
Published : 2022-03-18 14:15
Updated : 2024-11-21 06:51
NVD link : CVE-2022-24772
Mitre link : CVE-2022-24772
CVE.ORG link : CVE-2022-24772
JSON object : View
Products Affected
digitalbazaar
- forge
CWE
CWE-347
Improper Verification of Cryptographic Signature