Browserify Sign
Approved changes feed: RSS · Atom
cpe:2.3:a:browserify:browserify-sign:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Browserify (35a535b1-4062-5a71-ab31-40db347356ed) |
|---|---|
| Product | Browserify Sign (0b8605f6-a5ec-5912-b973-2f5a8dc62ebf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/browserify/browserify-sign |
purl2cpe | 2026-06-01 10:11:41.480550 |
pkg:maven/org.webjars.npm/browserify-sign |
purl2cpe | 2026-06-01 10:11:41.480553 |
pkg:npm/browserify-sign |
purl2cpe | 2026-06-01 10:11:41.480556 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-46234 |
vulnerable | 2026-06-08 06:12:44.452187 |
browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack
MEDIUM (6.5)
browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.
Published: 2023-10-26T14:31:35.895Z
Updated: 2025-02-13T17:14:23.092Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.