First published: Thu Oct 26 2023(Updated: )
### Summary An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. ### Details In `dsaVerify` function, it checks whether the value of the signature is legal by calling function `checkValue`, namely, whether `r` and `s` are both in the interval `[1, q - 1]`. However, the second line of the `checkValue` function wrongly checks the upper bound of the passed parameters, since the value of `b.cmp(q)` can only be `0`, `1` and `-1`, and it can never be greater than `q`. In this way, although the values of `s` cannot be `0`, an attacker can achieve the same effect as zero by setting its value to `q`, and then send `(r, s) = (1, q)` to pass the verification of any public key. ### Impact All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. ### Fix PR: Since the temporary private fork was deleted, here's a webarchive of the PR discussion and diff pages: [PR webarchive.zip](https://github.com/browserify/browserify-sign/files/13172957/PR.webarchive.zip)
Credit: security-advisories@github.com security-advisories@github.com
Affected Software | Affected Version | How to fix |
---|---|---|
debian/node-browserify-sign | <=4.2.1-1<=4.2.1-3 | 4.2.2-1 4.2.1-3+deb12u1 4.2.1-1+deb11u1 |
redhat/browserify-sign | <4.2.2 | 4.2.2 |
npm/browserify-sign | >=2.6.0<=4.2.1 | 4.2.2 |
Browserify Browserify-sign | <4.2.2 | |
Debian Debian Linux | =11.0 | |
Debian Debian Linux | =12.0 | |
debian/node-browserify-sign | <=4.0.4-2 | 4.0.4-2+deb10u1 4.2.1-1+deb11u1 4.2.1-3+deb12u1 4.2.2-1 |
ubuntu/node-browserify-sign | <4.0.4-2ubuntu0.18.04.1~ | 4.0.4-2ubuntu0.18.04.1~ |
ubuntu/node-browserify-sign | <4.0.4-2ubuntu0.20.04.1 | 4.0.4-2ubuntu0.20.04.1 |
ubuntu/node-browserify-sign | <4.2.1-2ubuntu0.1 | 4.2.1-2ubuntu0.1 |
ubuntu/node-browserify-sign | <4.2.1-3ubuntu0.1 | 4.2.1-3ubuntu0.1 |
<4.2.2 | ||
=11.0 | ||
=12.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2023-46234 is a vulnerability in the browserify-sign package that allows an attacker to construct signatures which can be successfully verified by any public key, leading to a signature forgery attack.
CVE-2023-46234 works by exploiting an upper bound check issue in the dsaVerify function of the browserify-sign package.
CVE-2023-46234 has a severity rating of 7.5 (high).
The browserify-sign package with versions 2.6.0 to 4.2.1 (inclusive) is affected by CVE-2023-46234.
To fix CVE-2023-46234, update the browserify-sign package to version 4.2.2 or higher.