Improper Verification of Cryptographic Signature in browserify-sign - CVE-2023-46234

Vulnerability identifier: #VU82608

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-46234

CWE-ID: CWE-347

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to an error in the dsaVerify() function when validating public keys. A remote attacker can construct a public key in a way that it will be accepted as valid by the affected application and perform spoofing attack.

browserify-sign
Cognos Dashboards on Cloud Pak for Data
Cognos Analytics Mobile (iOS)
Cognos Analytics Mobile (Android)
IBM Planning Analytics Workspace
QRadar Deployment Intelligence App
Debian Linux
Fedora
Ubuntu
QRadar Suite
Red Hat OpenShift distributed tracing (RHOSDT)
Confluence Data Center
QRadar User Behavior Analytics
App Connect Enterprise Certified Container
node-browserify-sign (Ubuntu package)
yarnpkg
node-browserify-sign (Debian package)
Cloud Pak for Data

Install updates from vendor's website.

browserify-sign - update to 4.2.2
QRadar Suite - update to 1.10.18.0
Confluence Data Center - addressed in versions 7.19.29, 8.5.17, 8.9.8, 9.1.1
node-browserify-sign (Ubuntu package) - addressed in versions Ubuntu Pro, 4.0.4-2ubuntu0.20.04.1, 4.2.1-2ubuntu0.1, 4.2.1-3ubuntu0.1
Cognos Analytics Mobile (iOS) - update to 1.1.20
Cognos Analytics Mobile (Android) - update to 1.1.20
yarnpkg - addressed in versions 1.22.21-2.fc38, 1.22.21-2.fc39, 1.22.22-5.el9
IBM Planning Analytics Workspace - update to 2.0.94
QRadar Deployment Intelligence App - update to 3.0.13
QRadar User Behavior Analytics - update to 4.1.16
node-browserify-sign (Debian package) - addressed in versions 4.2.1-1+deb11u1, 4.2.1-3+deb12u1
Cloud Pak for Data - update to 4.8.5
App Connect Enterprise Certified Container - addressed in versions 5.0.13, 11.0.0

• https://github.com/browserify/browserify-sign/security/advisories/GHSA-x9w5-v3q2-3rhw
• https://github.com/browserify/browserify-sign/commit/85994cd6348b50f2fd1b73c54e20881416f44a30
• https://lists.debian.org/debian-lts-announce/2023/10/msg00040.html
• https://www.debian.org/security/2023/dsa-5539

• Spoofing attack in browserify-sign
• Debian update for node-browserify-sign
• Multiple vulnerabilities in Red Hat Openshift distributed tracing
• App Connect Enterprise Certified Container update for browserify-sign
• Multiple vulnerabilities in IBM QRadar Suite Software
• Fedora 38 update for yarnpkg
• Fedora 39 update for yarnpkg
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in IBM Planning Analytics
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Ubuntu update for node-browserify-sign
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Improper verification of cryptographic signature in IBM Cloud Pak for Data
• Fedora EPEL 9 update for yarnpkg
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (Android)
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (iOS)
• Confluence Data Center update for browserify-sign