Critical Vulnerability in node-node-forge: Insecure RSA PKCS#1 v1.5 Signature Verification
Summary
DEBIAN-CVE-2022-24772: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Affects node-node-forge versions < 0.10.0~dfsg-3+deb11u1. Fixed in 0.10.0~dfsg-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-node-forge is a JavaScript library that provides a native implementation of Transport Layer Security (TLS). It is widely used for secure communications and cryptographic operations. The library supports various cryptographic functionalities, including RSA encryption and signature verification. However, prior to version 1.3.0, it contained a significant vulnerability in its RSA PKCS#1 v1.5 signature verification code, which could lead to security breaches.
Vulnerability Detail
The vulnerability arises from the failure of the RSA PKCS#1 v1.5 signature verification code to check for trailing garbage bytes after decoding a DigestInfo ASN.1 structure. This oversight allows attackers to manipulate the signature verification process by removing padding bytes and adding garbage data, particularly when a low public exponent is used. This could potentially lead to unauthorized access or data manipulation, posing a serious security risk.
How To Fix
Minimum fixed version
0.10.0~dfsg-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-node-forgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability other than updating to the fixed version of the package.
Conclusion
The vulnerability in node-node-forge poses a significant risk due to its potential to allow signature forgery. It is crucial for users of this package to update to the latest version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for node-node-forge →
FAQ
The vulnerability can allow attackers to forge signatures, potentially leading to unauthorized access or data manipulation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions prior to 1.3.0 are affected by this vulnerability.
Yes, the vulnerability has been addressed in node-node-forge version 1.3.0.
It is recommended to update to the patched version as soon as possible, as there are currently no workarounds available.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-node-forge.
