Browserify Browserify-Sign vulnerabilities

1 known vulnerability affecting browserify/browserify-sign.

Total CVEs

1

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH1

Vulnerabilities

Page 1 of 1

CVE-2023-46234HIGHCVSS 7.5fixed in 4.2.2v>= 2.6.0, <= 4.2.12023-10-26

CVE-2023-46234 [HIGH] CWE-347 CVE-2023-46234: browserify-sign is a package to duplicate the functionality of node's crypto public key functions, m browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack