Bump node-forge from 1.3.0 to 1.3.2#112
Open
renovate-pagopa[bot] wants to merge 1 commit intomasterfrom
Open
Conversation
Jira Pull request LinkIt seems this Pull Request has no issues that refers to Jira!!! |
|
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.3.0->1.3.2For further information on security, please refer to the Confluence page link
Release Notes
digitalbazaar/forge (node-forge)
v1.3.2Compare Source
Security
1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1
structures to desynchronize schema validations, yielding a semantic
divergence that may bypass downstream cryptographic verifications and
security decisions.
1.3.1 and below enables remote, unauthenticated attackers to craft deep
ASN.1 structures that trigger unbounded recursive parsing. This leads to a
Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER
inputs.
and below enables remote, unauthenticated attackers to craft ASN.1
structures containing OIDs with oversized arcs. These arcs may be decoded
as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the
bypass of downstream OID-based security decisions.
Fixed
verification bypass due to missing macData enforcement and improper
asn1.validate routine.
fromDer()max recursion depth check.asn1.maxDepthglobal configurable maximum depth of 256.asn1.fromDer()per-callmaxDepthoption.data. If this assumption is false then this could be a breaking change.
Please file an issue if there are use cases that need a higher maximum.
maxDepthparameter has not been exposed up throughall of the API stack due to the complexities involved. Please file an issue
if there are use cases that require this instead of changing the default
maximum.
2**32 - 1.2**53 - 1.v1.3.1Compare Source
Security
1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1
structures to desynchronize schema validations, yielding a semantic
divergence that may bypass downstream cryptographic verifications and
security decisions.
1.3.1 and below enables remote, unauthenticated attackers to craft deep
ASN.1 structures that trigger unbounded recursive parsing. This leads to a
Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER
inputs.
and below enables remote, unauthenticated attackers to craft ASN.1
structures containing OIDs with oversized arcs. These arcs may be decoded
as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the
bypass of downstream OID-based security decisions.
Fixed
verification bypass due to missing macData enforcement and improper
asn1.validate routine.
fromDer()max recursion depth check.asn1.maxDepthglobal configurable maximum depth of 256.asn1.fromDer()per-callmaxDepthoption.data. If this assumption is false then this could be a breaking change.
Please file an issue if there are use cases that need a higher maximum.
maxDepthparameter has not been exposed up throughall of the API stack due to the complexities involved. Please file an issue
if there are use cases that require this instead of changing the default
maximum.
2**32 - 1.2**53 - 1.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.