Bug 2067461 (CVE-2022-24773)
| Summary: | CVE-2022-24773 node-forge: Signature verification leniency in checking `DigestInfo` structure | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aileenc, alazarot, amackenz, amasferr, amctagga, andrew.slice, anstephe, aos-bugs, bdettelb, bodavis, caswilli, cfeist, chazlett, cheese, cluster-maint, crummel, dan.cermak, dbhole, dotnet-packagers, drieden, eclipseo, ellin, emingora, eric.wittmann, etamir, etirelli, extras-orphan, fboucher, fjansen, francisco.vergarat, gmalinko, go-sig, gparvin, harold, hbraun, huzaifas, ibek, idevat, janstey, jkoehler, jnethert, jochrist, jramanat, jrokos, jross, jschatte, jstastny, jwendell, jwong, jwon, kanderso, kaycoth, kmalyjur, krathod, kverlaen, lemenkov, link, lvaleeva, mail, micjohns, mkudlej, mlisik, mnovotny, mpospisi, mwringe, nbecker, nboldt, njean, ocs-bugs, omajid, omular, openstack-sig, oskutka, ovanders, pabelanger, pahickey, pantinor, pdelbell, pjindal, ploffay, psegedy, rareddy, rcernich, rebus, rfreiman, rgarg, rgodfrey, rguimara, rjanekov, rrajasek, rwagner, scorneli, shbose, stcannon, sthirugn, stjepan.gros, tcarlin, tjochec, tkasparek, tojeline, tsasak, twalsh, tzimanyi, ubhargav, vkrizan, vmugicag, xavier |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | node-forge 1.3.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the node-forge library when verifying the signature on the ASN.1 structure in RSA PKCS#1 v1.5. This flaw allows an attacker to obtain successful verification for invalid DigestInfo structure, affecting the integrity of the attacked resource.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-06 00:46:17 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2069036, 2069027, 2069028, 2069029, 2069030, 2069031, 2069032, 2069033, 2069034, 2069035, 2069223, 2069225, 2069226, 2069608, 2069609, 2069611, 2078888, 2078889, 2078890, 2102577 | ||
| Bug Blocks: | 2067462 | ||
|
Description
Pedro Sampaio
2022-03-23 20:54:55 UTC
Created cockatrice tracking bugs for this issue: Affects: fedora-all [bug 2069028] Created couchdb tracking bugs for this issue: Affects: fedora-all [bug 2069030] Created dotnet3.1 tracking bugs for this issue: Affects: fedora-all [bug 2069027] Created golang-ariga-atlas tracking bugs for this issue: Affects: fedora-all [bug 2069031] Created golang-github-prometheus tracking bugs for this issue: Affects: epel-all [bug 2069036] Created golang-vitess tracking bugs for this issue: Affects: fedora-all [bug 2069032] Created grpc tracking bugs for this issue: Affects: fedora-all [bug 2069033] Created openvas-gsa tracking bugs for this issue: Affects: fedora-all [bug 2069034] Created zuul tracking bugs for this issue: Affects: fedora-all [bug 2069035] This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 Via RHSA-2022:1681 https://access.redhat.com/errata/RHSA-2022:1681 This issue has been addressed in the following products: OpenShift Service Mesh 2.1 Via RHSA-2022:1739 https://access.redhat.com/errata/RHSA-2022:1739 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-24773 This issue has been addressed in the following products: Red Hat OpenShift Data Foundation 4.11 on RHEL8 Via RHSA-2022:6156 https://access.redhat.com/errata/RHSA-2022:6156 This issue has been addressed in the following products: RHINT Service Registry 2.3.0 GA Via RHSA-2022:6835 https://access.redhat.com/errata/RHSA-2022:6835 |