Browserify Sign
Approved changes feed: RSS · Atom
cpe:2.3:a:browserify:browserify-sign:*:*:*:*:*:node.js:*:*
part: a version: * update: *
| Vendor | Browserify (35a535b1-4062-5a71-ab31-40db347356ed) |
|---|---|
| Product | Browserify Sign (0b8605f6-a5ec-5912-b973-2f5a8dc62ebf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-46234 |
vulnerable | 2026-06-08 06:12:44.452842 |
browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack
MEDIUM (6.5)
browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.
Published: 2023-10-26T14:31:35.895Z
Updated: 2025-02-13T17:14:23.092Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.