Signature Forgery Vulnerability in node-browserify-sign Package
Summary
CVE-2023-46234: browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. Affects node-browserify-sign across 2 version ranges.
< 4.2.1-1+deb11u1
< 85994cd6348b50f2fd1b73c54e20881416f44a30
Fixed in 4.2.1-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-browserify-sign package is designed to replicate the functionality of Node.js's crypto public key functions, primarily focusing on DSA (Digital Signature Algorithm) verification. This package is widely used in applications that require secure signing and verification of data. However, it has been found to have a critical vulnerability that affects its ability to securely verify user-input signatures.
Vulnerability Detail
An upper bound check issue in the dsaVerify function of the node-browserify-sign package allows attackers to create signatures that can be verified by any public key. This vulnerability can lead to signature forgery attacks, where an attacker could impersonate a legitimate user or manipulate data without detection. The flaw stems from improper validation of input signatures, making it a significant security risk for applications relying on this package for cryptographic operations.
How To Fix
Minimum fixed version
4.2.1-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-browserify-signTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing additional validation checks on signatures before processing them. This can help mitigate the risk of signature forgery until the package can be updated.
Conclusion
The node-browserify-sign package has a critical vulnerability that allows for signature forgery due to improper validation in the dsaVerify function. It is crucial for users of this package to update to the patched versions to mitigate the risk. Additionally, implementing workarounds and utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for node-browserify-sign →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions prior to 4.2.2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to signature forgery, allowing attackers to impersonate users or manipulate data, which can compromise the integrity and security of the application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for node-browserify-sign.
