USN-6800-1: browserify-sign vulnerability

Releases

• Ubuntu 23.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• node-browserify-sign - createSign and createVerify in your browser

Details

It was discovered that browserify-sign incorrectly handled an upper bound check
in signature verification. If a user or an automated system were tricked into
opening a specially crafted input file, a remote attacker could possibly use
this issue to perform a signature forgery attack.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.10

• node-browserify-sign - 4.2.1-3ubuntu0.1

Ubuntu 22.04

• node-browserify-sign - 4.2.1-2ubuntu0.1

Ubuntu 20.04

• node-browserify-sign - 4.0.4-2ubuntu0.20.04.1

Ubuntu 18.04

• node-browserify-sign - 4.0.4-2ubuntu0.18.04.1~esm1
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-46234