Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTV3MjUtaHhwNS1oOGM5

Improper Verification of Cryptographic Signature

tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the verifyWithMessage method of tEnvoyNaClSigningKey always returns true for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In tenvoy.js under the verifyWithMessage method definition within the tEnvoyNaClSigningKey class, ensure that the return statement call to this.verify ends in .verified.

Permalink: https://github.com/advisories/GHSA-5w25-hxp5-h8c9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTV3MjUtaHhwNS1oOGM5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 3 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-5w25-hxp5-h8c9, CVE-2021-32685
References:

• https://github.com/TogaTech/tEnvoy/security/advisories/GHSA-7r96-8g3x-g36m
• https://nvd.nist.gov/vuln/detail/CVE-2021-32685
• https://github.com/TogaTech/tEnvoy/commit/a121b34a45e289d775c62e58841522891dee686b
• https://github.com/TogaTech/tEnvoy/releases/tag/v7.0.3
• https://github.com/advisories/GHSA-5w25-hxp5-h8c9

Repository: https://github.com/TogaTech/tEnvoy
Blast Radius: 0.0

Affected Packages