CVE-2023-46234: browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack
(updated )
An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack.
References
- github.com/advisories/GHSA-x9w5-v3q2-3rhw
- github.com/browserify/browserify-sign
- github.com/browserify/browserify-sign/commit/85994cd6348b50f2fd1b73c54e20881416f44a30
- github.com/browserify/browserify-sign/security/advisories/GHSA-x9w5-v3q2-3rhw
- lists.debian.org/debian-lts-announce/2023/10/msg00040.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ
- nvd.nist.gov/vuln/detail/CVE-2023-46234
- www.debian.org/security/2023/dsa-5539
Code Behaviors & Features
Detect and mitigate CVE-2023-46234 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →