CVE-2022-24772: Improper Verification of Cryptographic Signature (CWE-347)
value: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 7.5
Published: 2022-03-18T14:15Z
Repository: https://github.com/digitalbazaar/forge
Language: Markdown
Files changed: CHANGELOG.md
Commit date: 2022-03-17 19:15:07 -0400
Commit message: Add advisory links.

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 231efeba..a7384fb8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,23 +13,29 @@ Forge ChangeLog
     portion of the PKCS#1 encoded message to forge a signature when a low
     public exponent is being used. For more information, please see
     ["Bleichenbacher's RSA signature forgery based on implementation
     error"](https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE/)
     by Hal Finney.
+  - CVE ID: [CVE-2022-24771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771)
+  - GHSA ID: [GHSA-cfm4-qjh2-4765](https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765)
 - **HIGH**: Failing to check tailing garbage bytes can lead to signature
   forgery.
   - The code does not check for tailing garbage bytes after decoding a
     `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed
     and garbage data added to forge a signature when a low public exponent is
     being used.  For more information, please see ["Bleichenbacher's RSA
     signature forgery based on implementation
     error"](https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE/)
     by Hal Finney.
+  - CVE ID: [CVE-2022-24772](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772)
+  - GHSA ID: [GHSA-x4jg-mjrx-434g](https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g)
 - **MEDIUM**: Leniency in checking type octet.
   - `DigestInfo` is not properly checked for proper ASN.1 structure. This can
     lead to successful verification with signatures that contain invalid
     structures but a valid digest.
+  - CVE ID: [CVE-2022-24773](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773)
+  - GHSA ID: [GHSA-2r2c-g63r-vccr](https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr)
 
 ### Fixed
 - [asn1] Add fallback to pretty print invalid UTF8 data.
 - [asn1] `fromDer` is now more strict and will default to ensuring all input
   bytes are parsed or throw an error. A new option `parseAllBytes` can disable

Fixed code:   - CVE ID: [CVE-2022-24771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771)
  - GHSA ID: [GHSA-cfm4-qjh2-4765](https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765)
  - CVE ID: [CVE-2022-24772](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772)
  - GHSA ID: [GHSA-x4jg-mjrx-434g](https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g)
  - CVE ID: [CVE-2022-24773](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773)
  - GHSA ID: [GHSA-2r2c-g63r-vccr](https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr)