Bug 2067387 (CVE-2022-24771)
| Summary: | CVE-2022-24771 node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aileenc, alazarot, amackenz, amasferr, amctagga, andrew.slice, anstephe, aos-bugs, bdettelb, bodavis, caswilli, cfeist, chazlett, cheese, cluster-maint, crummel, dan.cermak, dbhole, dotnet-packagers, drieden, eclipseo, ellin, emingora, eric.wittmann, etamir, etirelli, extras-orphan, fboucher, fjansen, francisco.vergarat, gmalinko, go-sig, gparvin, harold, hbraun, huzaifas, ibek, idevat, janstey, jkoehler, jnethert, jochrist, jramanat, jrokos, jross, jschatte, jstastny, jwendell, jwong, jwon, kanderso, kaycoth, kmalyjur, krathod, kverlaen, lemenkov, link, lvaleeva, mail, micjohns, mkudlej, mlisik, mnovotny, mpospisi, mwringe, nbecker, nboldt, njean, ocs-bugs, omajid, omular, openstack-sig, oskutka, ovanders, pabelanger, pahickey, pantinor, pdelbell, pjindal, ploffay, psegedy, rareddy, rcernich, rebus, rfreiman, rgarg, rgodfrey, rguimara, rjanekov, rrajasek, rwagner, scorneli, shbose, stcannon, sthirugn, stjepan.gros, tcarlin, tjochec, tkasparek, tkral, tojeline, tsasak, twalsh, tzimanyi, ubhargav, vkrizan, vmugicag, xavier |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | node-forge 1.3.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the node-forge package. This signature verification leniency allows an attacker to forge a signature.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-06 00:16:28 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2069008, 2069007, 2069009, 2069010, 2069011, 2069012, 2069013, 2069014, 2069015, 2069016, 2069214, 2069215, 2069216, 2069589, 2069590, 2069591, 2078881, 2078882, 2078883, 2102579 | ||
| Bug Blocks: | 2067462 | ||
|
Description
Pedro Sampaio
2022-03-23 20:30:42 UTC
Created cockatrice tracking bugs for this issue: Affects: fedora-all [bug 2069010] Created couchdb tracking bugs for this issue: Affects: fedora-all [bug 2069011] Created dotnet3.1 tracking bugs for this issue: Affects: fedora-all [bug 2069007] Created golang-ariga-atlas tracking bugs for this issue: Affects: fedora-all [bug 2069012] Created golang-github-prometheus tracking bugs for this issue: Affects: epel-all [bug 2069008] Created golang-vitess tracking bugs for this issue: Affects: fedora-all [bug 2069013] Created grpc tracking bugs for this issue: Affects: fedora-all [bug 2069014] Created openvas-gsa tracking bugs for this issue: Affects: fedora-all [bug 2069015] Created zuul tracking bugs for this issue: Affects: fedora-all [bug 2069016] Since grpc only references the affected package in a package-lock.json file for a sample project in the documentation, I have closed the grpc bugs as NOTABUG. (See also bug 2061818.) I’m removing the package-lock.json file from the sample project, which will hopefully keep bugs from being filed for CVEs in its recursive dependency tree in the future. This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 Via RHSA-2022:1681 https://access.redhat.com/errata/RHSA-2022:1681 This issue has been addressed in the following products: OpenShift Service Mesh 2.1 Via RHSA-2022:1739 https://access.redhat.com/errata/RHSA-2022:1739 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-24771 This issue has been addressed in the following products: Red Hat OpenShift Data Foundation 4.11 on RHEL8 Via RHSA-2022:6156 https://access.redhat.com/errata/RHSA-2022:6156 This issue has been addressed in the following products: RHPAM 7.13.1 async Via RHSA-2022:6813 https://access.redhat.com/errata/RHSA-2022:6813 This issue has been addressed in the following products: RHINT Service Registry 2.3.0 GA Via RHSA-2022:6835 https://access.redhat.com/errata/RHSA-2022:6835 |