CVE-2022-24772 : Forge (also called `node-forge`) is a native implementation of Transport Layer S

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

Published 2022-03-18 14:15:10

Updated 2022-03-28 14:10:23

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2022-24772

Digitalbazaar » Forge » For Node.js
Versions before (<) 1.3.0
cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:node.js:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-24772

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 37 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-24772

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2022-24772

CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Assigned by: security-advisories@github.com (Primary)

References for CVE-2022-24772

https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1

Fix signature verification issues. · digitalbazaar/forge@3f0b49a · GitHub
Patch;Third Party Advisory

CVEs referencing this url
https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2

Add advisory links. · digitalbazaar/forge@bb822c0 · GitHub
Patch;Third Party Advisory

CVEs referencing this url
https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g

RSA PKCS#1 v1.5 signature verification failing to check tailing garbage bytes can lead to signature forgery. · Advisory · digitalbazaar/forge · GitHub
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-24772

Products affected by CVE-2022-24772

Exploit prediction scoring system (EPSS) score for CVE-2022-24772

CVSS scores for CVE-2022-24772

CWE ids for CVE-2022-24772

References for CVE-2022-24772