CVE-2022-24773: Improper Verification of Cryptographic Signature in `node-forge`
A flaw was found in the node-forge library when verifying the signature on the ASN.1 structure in RSA PKCS#1 v1.5. This flaw allows an attacker to obtain successful verification for invalid DigestInfo structure, affecting the integrity of the attacked resource.
Other sources
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-24773?
CVE-2022-24773 has been classified as a moderate severity vulnerability.
How do I fix CVE-2022-24773?
To fix CVE-2022-24773, upgrade the node-forge library to version 1.3.0 or later.
What is the impact of CVE-2022-24773?
CVE-2022-24773 allows attackers to achieve false positive signature verifications, which can compromise data integrity.
Which versions of node-forge are affected by CVE-2022-24773?
CVE-2022-24773 affects versions of node-forge prior to 1.3.0.
Is there a workaround for CVE-2022-24773 if I cannot update?
Currently, there are no known workarounds for CVE-2022-24773, and the best course of action is to update the library.