CVE-2023-46234

browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.

browserify-sign es un paquete para duplicar la funcionalidad de las funciones de clave pública criptográfica del nodo, gran parte de esto se basa en el trabajo de Fedor Indutny en indutny/tls.js. Un problema de verificación de límite superior en la función `dsaVerify` permite a un atacante construir firmas que pueden verificarse con éxito mediante cualquier clave pública, lo que lleva a un ataque de falsificación de firmas. Todos los lugares de este proyecto que implican la verificación DSA de las firmas ingresadas por los usuarios se verán afectados por esta vulnerabilidad. Este problema se solucionó en la versión 4.2.2.

A flaw was found in browserify-sign node package. This issue may allow a malicious user to execute a signature forgery attack by not correctly checking cryptographic signatures for DSA data, resulting in a jeopardized environment.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-10-19 CVE Reserved
2023-10-26 CVE Published
2024-08-02 CVE Updated
2024-11-01 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-347: Improper Verification of Cryptographic Signature

CAPEC

References (8)

URL	Tag	Source
https://github.com/browserify/browserify-sign/commit/85994cd6348b50f2fd1b73c54e20881416f44a30	Third Party Advisory
https://github.com/browserify/browserify-sign/security/advisories/GHSA-x9w5-v3q2-3rhw	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00040.html	Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ
https://www.debian.org/security/2023/dsa-5539	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2023-46234	2023-10-30
https://bugzilla.redhat.com/show_bug.cgi?id=2246470	2023-10-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Browserify Search vendor "Browserify"		Browserify-sign Search vendor "Browserify" for product "Browserify-sign"				< 4.2.2 Search vendor "Browserify" for product "Browserify-sign" and version " < 4.2.2"		node.js		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				12.0 Search vendor "Debian" for product "Debian Linux" and version "12.0"		-		Affected