Bug 2067458 (CVE-2022-24772)
| Summary: | CVE-2022-24772 node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aileenc, alazarot, amackenz, amasferr, amctagga, andrew.slice, anstephe, aos-bugs, bdettelb, bodavis, caswilli, cfeist, chazlett, cheese, cluster-maint, crummel, dan.cermak, dbhole, dotnet-packagers, drieden, eclipseo, ellin, emingora, eric.wittmann, etamir, etirelli, extras-orphan, fboucher, fjansen, francisco.vergarat, gmalinko, go-sig, gparvin, harold, hbraun, huzaifas, ibek, idevat, janstey, jkoehler, jnethert, jochrist, jramanat, jrokos, jross, jschatte, jstastny, jwendell, jwong, jwon, kanderso, kaycoth, kmalyjur, krathod, kverlaen, lemenkov, link, lvaleeva, mail, micjohns, mkudlej, mlisik, mnovotny, mpospisi, mwringe, nbecker, nboldt, njean, ocs-bugs, omajid, omular, openstack-sig, oskutka, ovanders, pabelanger, pahickey, pantinor, pdelbell, pjindal, ploffay, psegedy, rareddy, rcernich, rebus, rfreiman, rgarg, rgodfrey, rguimara, rjanekov, rrajasek, rwagner, scorneli, shbose, stcannon, sthirugn, stjepan.gros, tcarlin, tjochec, tkasparek, tojeline, tsasak, twalsh, tzimanyi, ubhargav, vkrizan, vmugicag, xavier |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | node-forge 1.3.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the node-forge package. This signature verification leniency allows an attacker to forge a signature.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-06 00:45:20 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2069018, 2069017, 2069019, 2069020, 2069021, 2069022, 2069023, 2069024, 2069025, 2069026, 2069218, 2069219, 2069220, 2069605, 2069606, 2069607, 2078885, 2078886, 2078887, 2102578 | ||
| Bug Blocks: | 2067462 | ||
|
Description
Pedro Sampaio
2022-03-23 20:38:01 UTC
Created cockatrice tracking bugs for this issue: Affects: fedora-all [bug 2069020] Created couchdb tracking bugs for this issue: Affects: fedora-all [bug 2069021] Created dotnet3.1 tracking bugs for this issue: Affects: fedora-all [bug 2069017] Created golang-ariga-atlas tracking bugs for this issue: Affects: fedora-all [bug 2069022] Created golang-github-prometheus tracking bugs for this issue: Affects: epel-all [bug 2069018] Created golang-vitess tracking bugs for this issue: Affects: fedora-all [bug 2069023] Created grpc tracking bugs for this issue: Affects: fedora-all [bug 2069024] Created openvas-gsa tracking bugs for this issue: Affects: fedora-all [bug 2069025] Created zuul tracking bugs for this issue: Affects: fedora-all [bug 2069026] This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 Via RHSA-2022:1681 https://access.redhat.com/errata/RHSA-2022:1681 This issue has been addressed in the following products: OpenShift Service Mesh 2.1 Via RHSA-2022:1739 https://access.redhat.com/errata/RHSA-2022:1739 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-24772 This issue has been addressed in the following products: Red Hat OpenShift Data Foundation 4.11 on RHEL8 Via RHSA-2022:6156 https://access.redhat.com/errata/RHSA-2022:6156 This issue has been addressed in the following products: RHPAM 7.13.1 async Via RHSA-2022:6813 https://access.redhat.com/errata/RHSA-2022:6813 This issue has been addressed in the following products: RHINT Service Registry 2.3.0 GA Via RHSA-2022:6835 https://access.redhat.com/errata/RHSA-2022:6835 |