Skip to content
OpenAdvisories
Medium USN-6800-1 1 CVE

node-browserify-sign vulnerability

Published May 30, 2024 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that browserify-sign incorrectly handled an upper bound check
in signature verification. If a user or an automated system were tricked into
opening a specially crafted input file, a remote attacker could possibly use
this issue to perform a signature forgery attack.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS node-browserify-sign 4.0.4-2ubuntu0.20.04.1
Ubuntu · 22.04 LTS 22.04:LTS node-browserify-sign 4.2.1-2ubuntu0.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS node-browserify-sign 4.0.4-2ubuntu0.18.04.1~esm1

Vulnerabilities 1

  • Medium 6.5
    CVE-2023-46234

    browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack

    browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures t…

    browserify browserify-sign reaper node-browserify-sign Debian Ubuntu Azure Linux npm

References

  • report
    https://ubuntu.com/security/CVE-2023-46234