Critical Vulnerability in node-node-forge: Improper RSA PKCS#1 v1.5 Signature Verification
Summary
DEBIAN-CVE-2022-24773: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Affects node-node-forge versions < 0.10.0~dfsg-3+deb11u1. Fixed in 0.10.0~dfsg-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
node-node-forge is a native JavaScript implementation of Transport Layer Security (TLS). It provides various cryptographic functionalities, including secure communication and data integrity. The package is widely used in applications requiring secure data transmission. However, prior to version 1.3.0, it contained a vulnerability in its RSA PKCS#1 v1.5 signature verification process, which could lead to security risks.
Vulnerability Detail
The vulnerability arises from the RSA PKCS#1 v1.5 signature verification code failing to properly check the 'DigestInfo' for a valid ASN.1 structure. This oversight allows for successful verification of signatures that, while containing a valid digest, have invalid structures. The implications of this vulnerability include potential exploitation by attackers to forge signatures, undermining the integrity of secure communications.
How To Fix
Minimum fixed version
0.10.0~dfsg-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-node-forgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The recommended action is to update to the patched version as soon as possible.
Conclusion
The node-node-forge package has a critical vulnerability related to RSA PKCS#1 v1.5 signature verification. Users are strongly advised to update to the patched version to ensure the security of their applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain software integrity.
See every vulnerability recorded for node-node-forge →
FAQ
The vulnerability involves improper verification of RSA PKCS#1 v1.5 signatures, allowing for potential forgery of signatures with invalid structures.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include the potential for attackers to forge signatures, which can compromise the integrity of secure communications and data.
Yes, the vulnerability has been addressed in node-node-forge version 1.3.0 and later. It is crucial to update to this version or higher.
While there are no workarounds available, it is essential to prioritize updating the package to mitigate the risk as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-node-forge.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
