Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Verification of Cryptographic Signature in `node-forge`
Vulnerability Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Vulnerability Type
密码学签名的验证不恰当
Vulnerability Title
Digital Bazaar Forge 数据伪造问题漏洞
Vulnerability Description
Digital Bazaar Forge是美国Digital Bazaar公司的一个 Tls 在 Javascript 中的本机实现以及用于编写基于加密和网络密集型 Web 应用程序的开源工具。 Digital Bazaar Forge 1.3.0之前版本存在数据伪造问题漏洞，该漏洞源于RSA PKCS#1 v1.5 签名验证码在解码 `DigestInfo` ASN.1 结构后不检查尾随垃圾字节。攻击者可以删除填充字节利用该漏洞添加垃圾数据以伪造签名。
CVSS Information
N/A
Vulnerability Type
N/A