browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Thu, 13 Feb 2025 17:30:00 +0000

Type Values Removed Values Added
Description browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2. browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.
Title browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack

Sun, 08 Sep 2024 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat openshift Distributed Tracing
CPEs cpe:/a:redhat:openshift_distributed_tracing:2.9::el8
Vendors & Products Redhat
Redhat openshift Distributed Tracing

Mon, 19 Aug 2024 22:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_distributed_tracing:2.9::el8
Vendors & Products Redhat
Redhat openshift Distributed Tracing

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-02-13T17:14:23.092Z

Reserved: 2023-10-19T20:34:00.946Z

Link: CVE-2023-46234

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2023-10-26T15:15:09.087

Modified: 2025-04-10T20:47:25.493

Link: CVE-2023-46234

cve-icon Redhat

Severity : Important

Publid Date: 2023-10-26T00:00:00Z

Links: CVE-2023-46234 - Bugzilla

cve-icon OpenCVE Enrichment

No data.