GHSA-9wg5-mj3p-v49q: Forge: Certificate signature verified with the issuer's RSA signature scheme
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), verifySignature(), lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and RSASSA-PSS parameters from the issuer certificate rather than the child certificate being verified. A child labeled as RSASSA-PSS could therefore be accepted with a PKCS#1 v1.5 signature when the issuer used PKCS#1 v1.5. The signature still had to be produced with the trusted issuer's private key, so this did not permit certificate identity forgery, but it could bypass policies that require a declared signature scheme. This issue is fixed in version 1.4.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.4.1
Event History
Frequently Asked Questions
Who is affected by this issue?
Applications using Forge/node-forge versions earlier than 1.4.1 that verify certificate signatures and enforce policies based on the certificate's declared RSA signature scheme are affected. The issue is relevant where acceptance of RSASSA-PSS-labeled certificates must be restricted to signatures using the declared scheme.
What does an attacker need to exploit it?
The attacker still needs a signature produced with the trusted issuer's private key. The issue does not enable certificate identity forgery; it can only bypass policies requiring the declared signature scheme.
Are default certificate-verification deployments exposed to identity forgery?
No. Although a child certificate labeled RSASSA-PSS could be accepted with a PKCS#1 v1.5 signature when its issuer used PKCS#1 v1.5, the trusted issuer's private key is still required to create that signature.
How can this be remediated?
Upgrade Forge/node-forge to version 1.4.1, which fixes the signature-scheme and RSASSA-PSS parameter selection behavior.