Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2022-24772 (High) detected in node-forge-1.2.1.tgz #1366

Closed
mend-for-github-com bot opened this issue Mar 20, 2022 · 0 comments · Fixed by #1369
Closed

CVE-2022-24772 (High) detected in node-forge-1.2.1.tgz #1366

mend-for-github-com bot opened this issue Mar 20, 2022 · 0 comments · Fixed by #1369
Assignees
@tmarkley
Labels
cve Security vulnerabilities detected by Dependabot or Mend high severity High severity CVE Mend: dependency security vulnerability Security vulnerability detected by Mend v2.0.0

Comments

@mend-for-github-com
Copy link

CVE-2022-24772 - High Severity Vulnerability

Vulnerable Library - node-forge-1.2.1.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-1.2.1.tgz

Dependency Hierarchy:

  • ❌ node-forge-1.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution: node-forge - 1.3.0
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Mar 20, 2022
@tmarkley tmarkley added high severity High severity CVE cve Security vulnerabilities detected by Dependabot or Mend labels Mar 21, 2022
tmarkley pushed a commit to tmarkley/OpenSearch-Dashboards that referenced this issue Mar 22, 2022
Bumps node-forge from v1.2.1 to v1.3.0
8e96649 
* Addresses CVEs: CVE-2022-24771, CVE-2022-24772, CVE-2022-24773
* [CHANGELOG](https://github.com/digitalbazaar/forge/blob/v1.3.0/CHANGELOG.md)

Resolves opensearch-project#1365
Resolves opensearch-project#1366
Resolves opensearch-project#1367

Signed-off-by: Tommy Markley <markleyt@amazon.com>
@tmarkley tmarkley self-assigned this Mar 22, 2022
@tmarkley tmarkley mentioned this issue Mar 22, 2022
Merged
7 tasks
tmarkley pushed a commit that referenced this issue Mar 23, 2022
Bumps node-forge from v1.2.1 to v1.3.0 (#1369)
bd15433 
* Addresses CVEs: CVE-2022-24771, CVE-2022-24772, CVE-2022-24773
* [CHANGELOG](https://github.com/digitalbazaar/forge/blob/v1.3.0/CHANGELOG.md)

Resolves #1365
Resolves #1366
Resolves #1367

Signed-off-by: Tommy Markley <markleyt@amazon.com>
@ZilongX ZilongX mentioned this issue Sep 29, 2022
Closed
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tmarkley tmarkley

Labels
cve Security vulnerabilities detected by Dependabot or Mend high severity High severity CVE Mend: dependency security vulnerability Security vulnerability detected by Mend v2.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Bumps node-forge from v1.2.1 to v1.3.0 tmarkley/OpenSearch-Dashboards
1 participant
@tmarkley