Bug 2528186 (CVE-2026-85393)
| Summary: | CVE-2026-85393 node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | abarbaro, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, aoconnor, aos-team-art-private, asdas, ataylor, bbrownin, bniver, cdrage, csuconic, dbruscin, dmayorov, doconnor, dpaolell, dschmidt, ehugonne, flucifre, fmariani, gmalinko, gmeno, gparvin, groman, gtully, janstey, jbalunas, jchui, jdelft, jhe, jlanda, jlledo, jprabhak, jsherman, jupierce, jwon, kaycoth, kshier, ktsao, kvanderr, lchilton, lgarciaa, mbenjamin, mbiarnes, mcarlett, mhackett, nboldt, oaljalju, pantinor, pdelbell, pjindal, ppalepu, ppostler, prdhamdh, psrna, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rstepani, rushinde, sfeifer, sghai, sidsharm, simaishi, sostapov, stcannon, suppawar, tbish, tcunning, tlavocat, tsedmik, tsze, vereddy, vlaad, watson-tool-maintainers, wtam, yfang, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in node-forge. This vulnerability allows a remote attacker to forge valid RSA PKCS#1 v1.5 signatures for arbitrary messages. The flaw occurs because the software fails to properly validate the element count in nested DigestAlgorithm sequences during signature verification. By embedding specially crafted data, an attacker can bypass signature validation, leading to potential integrity compromise.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-09-03 19:02:53 UTC
|