REDHAT-BUG-2452464: High severity npm/node-forge vulnerability
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing “garbage” bytes within the ASN structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN structure, rather than outside of it. Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries. Version 1.4.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
What conditions are required for an attacker to forge a signature?
The vulnerable verification path must be used with an RSA public key whose exponent is 3. An attacker can then craft a malformed RSASSA PKCS#1 v1.5 signature containing garbage bytes in the ASN structure and potentially exploit insufficient padding validation.
Which versions are affected and what version fixes the issue?
Versions prior to 1.4.0 are affected. Version 1.4.0 patches the signature-verification flaw.
What should teams prioritize when triaging exposure?
Prioritize applications that use node-forge to verify RSASSA PKCS#1 v1.5 signatures, especially where verification keys have public exponent e=3. The issue affects signature verification rather than signature generation.