CVE-2023-46234 browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack
An upper bound check flaw in browserify-sign allows attackers to forge DSA signatures, bypassing verification checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46234?
CVE-2023-46234 is a medium-severity vulnerability in Debian Debian Linux, published on 26 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.
Weakness: CWE-347
Which versions are affected by CVE-2023-46234?
2 open source packages ship an affected version, including browserify-sign. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
browserify-sign npm | From 2.6.0 | 4.2.2 |
browserify-sign npm | From 2.6.0 | 4.2.2 |
Products include Browserify Browserify-Sign, Debian Debian Linux.
How do I fix CVE-2023-46234?
Upgrade browserify-sign to 4.2.2 or later.
Is CVE-2023-46234 being exploited?
There is no known exploitation of CVE-2023-46234 in the wild and no public exploit code.
Sources
Also known as AZL-31719, CLSA-2026-1782521955, CLSA-2026-1782521956, DEBIAN-CVE-2023-46234, DLA-3635-1, DSA-5539-1 and 4 more.