CVE-2022-24773: Improper Verification of Cryptographic Signature
(updated )
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
References
- github.com/advisories/GHSA-2r2c-g63r-vccr
- github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1
- github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2
- github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr
- nvd.nist.gov/vuln/detail/CVE-2022-24773
Code Behaviors & Features
Detect and mitigate CVE-2022-24773 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →