browserify-sign is a package to duplicate the functionality of nodes crypto public key functions, much of this is based on Fedor Indutnys work on indutny/tls.js. An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.
Weakness
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Browserify-sign | Browserify | * | 4.2.2 (excluding) |
| Red Hat Developer Hub 1.2 on RHEL 9 | RedHat | rhdh/rhdh-hub-rhel9:1.2-154 | * |
| Node-browserify-sign | Ubuntu | bionic | * |
| Node-browserify-sign | Ubuntu | esm-apps/bionic | * |
| Node-browserify-sign | Ubuntu | esm-apps/focal | * |
| Node-browserify-sign | Ubuntu | esm-apps/jammy | * |
| Node-browserify-sign | Ubuntu | focal | * |
| Node-browserify-sign | Ubuntu | jammy | * |
| Node-browserify-sign | Ubuntu | lunar | * |
| Node-browserify-sign | Ubuntu | mantic | * |
| Node-browserify-sign | Ubuntu | trusty | * |
| Node-browserify-sign | Ubuntu | xenial | * |
Related Attack Patterns
References
- https://github.com/browserify/browserify-sign/commit/85994cd6348b50f2fd1b73c54e20881416f44a30
- https://github.com/browserify/browserify-sign/security/advisories/GHSA-x9w5-v3q2-3rhw
- https://lists.debian.org/debian-lts-announce/2023/10/msg00040.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/
- https://www.debian.org/security/2023/dsa-5539
- https://github.com/browserify/browserify-sign/commit/85994cd6348b50f2fd1b73c54e20881416f44a30
- https://github.com/browserify/browserify-sign/security/advisories/GHSA-x9w5-v3q2-3rhw
- https://lists.debian.org/debian-lts-announce/2023/10/msg00040.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/
- https://www.debian.org/security/2023/dsa-5539