Browserify browserify-sign 2.4.0 for Node.js

CPE Details

Browserify browserify-sign 2.4.0 for Node.js
browserify
browserify-sign
2.4.0
2023-11-02
14h06 +00:00
2023-11-02
14h06 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:browserify:browserify-sign:2.4.0:*:*:*:*:node.js:*:*

Informations

Vendor

browserify

Product

browserify-sign

Version

2.4.0

Target Software

node.js

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2023-46234 2023-10-26 14h31 +00:00 browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.
7.5
High