Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKCS#7 padding during CBC and ECB decryption and accepted zero, oversized, or mismatched padding bytes. Malformed ciphertext could consequently be accepted and up to four plaintext blocks could be silently removed, causing an integrity failure in applications that treated successful decryption as proof of valid padding. This issue is fixed in version 1.4.1.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…/forge/security/advisories/GHSA-2vgq-wchc-25w7 Diğer
• github.com/…ommit/81774ff99e2da64aec9a43591df45a360040c136 Diğer
• github.com/digitalbazaar/forge/releases/tag/v1.4.1 Diğer

Kayıt geçmişi

1. 29 Eki 2026 21:37Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-119191Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
• 7,4 CVE-2026-119190Forge (node-forge): verifyCertificateChain üzerinde basicConstraints atlatma açığı
• 5,9 CVE-2026-119189Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
• 7,5 CVE-2026-119188Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
• 7,5 CVE-2026-119187Forge: Denial of service in TLS record processing via call stack exhaustion
• 5,9 CVE-2026-119186Forge (node-forge) AES-GCM tagLength doğrulanmadığı için kimlik doğrulama atlatma açığı