CVE-2022-24772: Improper Verification of Cryptographic Signature
(updated )
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
References
- github.com/advisories/GHSA-x4jg-mjrx-434g
- github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1
- github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2
- github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g
- nvd.nist.gov/vuln/detail/CVE-2022-24772
Code Behaviors & Features
Detect and mitigate CVE-2022-24772 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →