Improper Verification of Cryptographic Signature in `node-forge`
CVE-2022-24773

5.3MEDIUM

Key Information:

Vendor: Digitalbazaar
Status: Forge
Vendor: CVE Published:; 18 March 2022

🔔 Create Digitalbazaar Vulnerability Alert

What is CVE-2022-24773?

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.