forge icon indicating copy to clipboard operation
forge copied to clipboard

Published 20 hours ago • verified publisher icon digitalbazaar

Improper Verification of Cryptographic Signature in `node-forge`

Open HermesZum opened this issue 3 years ago • 1 comments

RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used.

https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE/

HermesZum avatar Mar 29 '22 22:03 HermesZum

What's the issue? This text is from a security advisory that was addressed in 1.3.0.

davidlehn avatar Mar 29 '22 22:03 davidlehn