search

browserify / crypto-browserify

partial implementation of node's `crypto` for the browser
MIT License
654 stars 200 forks source link

[Security] update browserify-sign to the latest #206

Closed rastorc3v closed 7 months ago

rastorc3v commented 3 years ago

Current browserify-sign version has elliptic in dependency which contains security issue. Please update browserify-sign to fix it.

mkilpatrick commented 7 months ago

Semgrep also calls this out with the following information:

Affected versions of browserify-sign are vulnerable to Improper Verification Of Cryptographic Signature. The vulnerability lies in the checkValue function incorrectly verifying the upper bounds of the r and s components in a signature, enabling attackers to manipulate the s component by setting it to the prime number q, thereby simulating a zero value for s and potentially resulting in the unauthorized acceptance of maliciously signed messages during signature verification.

ljharb commented 7 months ago

@mkilpatrick that sounds like something different - if elliptic has a vulnerability, then that package needs to fix it. The CVE you reference was fixed in browserify-sign 4-5 months ago (https://github.com/browserify/browserify-sign/commit/85994cd6348b50f2fd1b73c54e20881416f44a30) and is in v4.2.2 of that package.

ljharb commented 7 months ago

if elliptic has a vulnerability, then that package needs to fix it - if there's a specific CVE, please link it.