https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:30:12 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-03158 bdu:2024-03158 https://cve.radiocsirt.org/vuln/bdu:2024-03158 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0145 certfr-2024-avi-0145 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0145 https://cve.radiocsirt.org/vuln/euvd-2026-216904 EUVD-2026-216904 https://cve.radiocsirt.org/vuln/euvd-2026-216904 https://cve.radiocsirt.org/vuln/fkie_cve-2023-46234 <p>browserify-sign is a package to duplicate the functionality of node&#39;s crypto public key functions, much of this is based on Fedor Indutny&#39;s work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.</p> <p>browserify-sign is a package to duplicate the functionality of node&#39;s crypto public key functions, much of this is based on Fedor Indutny&#39;s work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-46234 https://cve.radiocsirt.org/vuln/ghsa-x9w5-v3q2-3rhw <p><strong>Affected:</strong> npm: browserify-sign</p> <p>### Summary An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack.</p> <p>### Details In `dsaVerify` function, it checks whether the value of the signature is legal by calling function `checkValue`, namely, whether `r` and `s` are both in the interval `[1, q - 1]`. However, the second line of the `checkValue` function wrongly checks the upper bound of the passed parameters, since the value of `b.cmp(q)` can only be `0`, `1` and `-1`, and it can never be greater than `q`.</p> <p>In this way, although the values of `s` cannot be `0`, an attacker can achieve the same effect as zero by setting its value to `q`, and then send `(r, s) = (1, q)` to pass the verification of any public key.</p> <p>### Impact All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability.</p> <p>### Fix PR: Since the temporary private fork was deleted, here&#39;s a webarchive of the PR discussion and diff pages: [PR webarchive.zip](https://github.com/browserify/browserify-sign/files/13172957/PR.webarchive.zip)</p> <p><strong>Affected:</strong> npm: browserify-sign</p> <p>### Summary An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack.</p> <p>### Details In `dsaVerify` function, it checks whether the value of the signature is legal by calling function `checkValue`, namely, whether `r` and `s` are both in the interval `[1, q - 1]`. However, the second line of the `checkValue` function wrongly checks the upper bound of the passed parameters, since the value of `b.cmp(q)` can only be `0`, `1` and `-1`, and it can never be greater than `q`.</p> <p>In this way, although the values of `s` cannot be `0`, an attacker can achieve the same effect as zero by setting its value to `q`, and then send `(r, s) = (1, q)` to pass the verification of any public key.</p> <p>### Impact All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability.</p> <p>### Fix PR: Since the temporary private fork was deleted, here&#39;s a webarchive of the PR discussion and diff pages: [PR webarchive.zip](https://github.com/browserify/browserify-sign/files/13172957/PR.webarchive.zip)</p> https://cve.radiocsirt.org/vuln/ghsa-x9w5-v3q2-3rhw https://cve.radiocsirt.org/vuln/gsd-2023-46234 gsd-2023-46234 https://cve.radiocsirt.org/vuln/gsd-2023-46234 https://cve.radiocsirt.org/vuln/msrc_cve-2023-46234 msrc_CVE-2023-46234 https://cve.radiocsirt.org/vuln/msrc_cve-2023-46234 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14663-1 <p>velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media</p> <p>velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14663-1 https://cve.radiocsirt.org/vuln/rhba-2024:10184 <p>browserify-sign: upper bound check issue in dsaVerify leads to a signature forgery attack send: Code Execution Vulnerability in Send Library</p> <p>browserify-sign: upper bound check issue in dsaVerify leads to a signature forgery attack send: Code Execution Vulnerability in Send Library</p> https://cve.radiocsirt.org/vuln/rhba-2024:10184 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-46234 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: node-browserify-sign, Ubuntu:20.04:LTS: node-browserify-sign, Ubuntu:22.04:LTS: node-browserify-sign</p> <p>browserify-sign is a package to duplicate the functionality of node&#39;s crypto public key functions, much of this is based on Fedor Indutny&#39;s work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: node-browserify-sign, Ubuntu:20.04:LTS: node-browserify-sign, Ubuntu:22.04:LTS: node-browserify-sign</p> <p>browserify-sign is a package to duplicate the functionality of node&#39;s crypto public key functions, much of this is based on Fedor Indutny&#39;s work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-46234 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2782 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift distributed tracing ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift distributed tracing ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2782