REDHAT-BUG-2417397: Medium severity npm/node-forge vulnerability
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.3.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using node-forge 1.3.1 or earlier are exposed when they parse untrusted DER input. The affected component is the ASN.1 parser.
What does an attacker need to exploit the flaw?
An attacker only needs to send a crafted, deeply nested ASN.1 structure in DER input to a vulnerable parser. No authentication is required.
What is the impact of successful exploitation?
Processing the crafted DER input can cause unbounded recursive parsing and exhaust the stack, resulting in a denial of service.
What should be done if the application uses an affected version?
Upgrade node-forge to version 1.3.2, which contains the patch. Until upgrading, avoid parsing DER inputs from untrusted sources where possible.