IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.5Hoch

CVE-2026-33895Forge has signature forgery in Ed25519 due to missing S > L check

digitalbazaar forge; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Cluster Ob… Veröffentlicht: (vor 7 Monaten)

Beschreibung

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed. Version 1.4.0 patches the issue.

Schwachstellentyp (CWE): CWE-347

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
ansible automation platform 2.5 —
cluster observability operator 1.5 —
digitalbazaar forge < 1.4.0
Red Hat Cluster Observability Operator 1.5.0 all versions
Red Hat Cryostat 4 —
Red Hat Logging Subsystem for Red Hat OpenShift all versions
Red Hat Red Hat Ansible Automation Platform 2 —
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 all versions
Red Hat Red Hat build of Apache Camel - HawtIO 4 —
Red Hat Red Hat build of Apicurio Registry 2 all versions
Red Hat Red Hat Build of Podman Desktop all versions
Red Hat Red Hat Data Grid 8 all versions
Red Hat Red Hat Developer Hub 1.8 all versions
Red Hat Red Hat Developer Hub 1.9 all versions
Red Hat Red Hat Enterprise Linux 10 —
Red Hat Red Hat Enterprise Linux 8 —
Red Hat Red Hat Enterprise Linux 9 —
Red Hat Red Hat Fuse 7 all versions
Red Hat Red Hat Process Automation 7 —
Red Hat Red Hat Quay 3 all versions
rhdh 1.8 —
rhdh 1.9 —

Referenzen und Patches

CPE-Treffer (NVD) (1)
  • cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:node.js:*:* ≤ 1.3.3

Neue CVEs im selben Produkt — Red Hat Enterprise Linux

5.5Mittel
CVE-2026-110330

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Hoch
CVE-2026-110331

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…