CVE-2022-24772 (High) detected in node-forge-1.2.1.tgz #1366
Assignees
Labels
cve
Security vulnerabilities detected by Dependabot or Mend
high severity
High severity CVE
Mend: dependency security vulnerability
Security vulnerability detected by Mend
v2.0.0
Comments
mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
tmarkley
added
high severity
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Mar 22, 2022
* Addresses CVEs: CVE-2022-24771, CVE-2022-24772, CVE-2022-24773 * [CHANGELOG](https://github.com/digitalbazaar/forge/blob/v1.3.0/CHANGELOG.md) Resolves opensearch-project#1365 Resolves opensearch-project#1366 Resolves opensearch-project#1367 Signed-off-by: Tommy Markley <[email protected]>
7 tasks
tmarkley
pushed a commit
that referenced
this issue
Mar 23, 2022
* Addresses CVEs: CVE-2022-24771, CVE-2022-24772, CVE-2022-24773 * [CHANGELOG](https://github.com/digitalbazaar/forge/blob/v1.3.0/CHANGELOG.md) Resolves #1365 Resolves #1366 Resolves #1367 Signed-off-by: Tommy Markley <[email protected]>
6 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
CVE-2022-24772 - High Severity Vulnerability
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-1.2.1.tgz
Dependency Hierarchy:
Found in base branch: main
Forge (also called
node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding aDigestInfoASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed innode-forgeversion 1.3.0. There are currently no known workarounds.Publish Date: 2022-03-18
URL: CVE-2022-24772
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772
Release Date: 2022-03-18
Fix Resolution: node-forge - 1.3.0
The text was updated successfully, but these errors were encountered: