CVE-2023-46234: Browserify sign Browserify-sign Upper Bound Check Issue Vulnerability
HIGHCVE-2023-46234 is a HIGH (CVSS 7.5) browserify-sign upper bound check issue vulnerability (CWE-347: Improper Verification of Cryptographic Signature) affecting Browserify sign libraries in the npm ecosystem. The issue involves browserify-sign upper bound check issue in `dsaverify` leads to a signature forgery attack. Remediation is available by upgrading affected packages to version 4.2.2.
CVE-2023-46234 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
How to Fix CVE-2023-46234
To remediate this vulnerability, upgrade all affected Browserify sign dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install browserify-sign@4.2.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls browserify-signHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2023-46234, inspect your project dependencies using npm:
npm ls browserify-signAnalyze the terminal output to locate any version of Browserify sign in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.2.2), your application is affected.
Note: The npm ls browserify-sign command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-347: Improper Verification of Cryptographic Signature, where the product does not verify, or incorrectly verifies, the cryptographic signature for data. In Browserify sign, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2023-46234 Affected Browserify sign Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
browserify-sign
|
npm |
≥ 2.6.0
< 4.2.2
|
4.2.2
|
References
Frequently Asked Questions
What is CVE-2023-46234?
Which Browserify sign versions are affected?
What version fixes CVE-2023-46234?
Is browserify-sign affected?
What is the CVSS score of CVE-2023-46234?
What CWE is associated with CVE-2023-46234?
How can I check npm dependencies for CVE-2023-46234?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-x9w5-v3q2-3rhw",
"modified" : "2025-02-13T19:19:37Z",
"published" : "2023-10-26T20:53:21Z",
"aliases" : [ "CVE-2023-46234" ],
"summary" : "browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack",
"details" : "### Summary\nAn upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack.\n\n### Details\nIn `dsaVerify` function, it checks whether the value of the signature is legal by calling function `checkValue`, namely, whether `r` and `s` are both in the interval `[1, q - 1]`. However, the second line of the `checkValue` function wrongly checks the upper bound of the passed parameters, since the value of `b.cmp(q)` can only be `0`, `1` and `-1`, and it can never be greater than `q`. \n\nIn this way, although the values of `s` cannot be `0`, an attacker can achieve the same effect as zero by setting its value to `q`, and then send `(r, s) = (1, q)` to pass the verification of any public key.\n\n### Impact\nAll places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability.\n\n\n### Fix PR:\nSince the temporary private fork was deleted, here's a webarchive of the PR discussion and diff pages: [PR webarchive.zip](https://github.com/browserify/browserify-sign/files/13172957/PR.webarchive.zip)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "browserify-sign"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.6.0"
}, {
"fixed" : "4.2.2"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 4.2.1"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/browserify/browserify-sign/security/advisories/GHSA-x9w5-v3q2-3rhw"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-46234"
}, {
"type" : "WEB",
"url" : "https://github.com/browserify/browserify-sign/commit/85994cd6348b50f2fd1b73c54e20881416f44a30"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/browserify/browserify-sign"
}, {
"type" : "WEB",
"url" : "https://lists.debian.org/debian-lts-announce/2023/10/msg00040.html"
}, {
"type" : "WEB",
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2"
}, {
"type" : "WEB",
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ"
}, {
"type" : "WEB",
"url" : "https://www.debian.org/security/2023/dsa-5539"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-347" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2023-10-26T20:53:21Z",
"nvd_published_at" : "2023-10-26T15:15:09Z"
}
}