CVE-2023-46234
Assigner: GitHub_M
Published: 2023-10-26T14:31:35.895Z
State: PUBLISHED
title: browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack 
problemTypes: descriptions: cweId: CWE-347
description: CWE-347: Improper Verification of Cryptographic Signature
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
affected: vendor: browserify
product: browserify-sign
versions: version: >= 2.6.0, <= 4.2.1
status: affected
descriptions: value: browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.

source: advisory: GHSA-x9w5-v3q2-3rhw
discovery: UNKNOWN