GMS-2020-547: Holder can generate proof of ownership for credentials it does not control in vp-toolkit

March 6, 2020

The verifyVerifiablePresentation() method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the credentialSubject.id` DID matches the signer of the VP proof.

References

github.com/advisories/GHSA-ff5x-w9wg-h275
github.com/rabobank-blockchain/vp-toolkit/commit/18a7db84d3265c6ffa10ef63eb37ae1bd4ba192b
github.com/rabobank-blockchain/vp-toolkit/issues/14
github.com/rabobank-blockchain/vp-toolkit/security/advisories/GHSA-ff5x-w9wg-h275

Code Behaviors & Features

Detect and mitigate GMS-2020-547 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →