Insecure digital certificates In pcs
Description
A flaw was found in Forge (also known as node-forge), a JavaScript implementation of Transport Layer Security (TLS). The pki.verifyCertificateChain() function does not properly enforce certificate validation rules. This oversight allows an intermediate certificate that lacks specific security extensions to enable any leaf certificate to function as a Certificate Authority (CA) and sign other certificates. Consequently, node-forge could accept these unauthorized certificates as valid, potentially leading to spoofing or the issuance of illegitimate certificates.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel9 | - | - | |
 npm | 1.4.0 | ||
rpm rhel8 | - | - |
Aliases
1. 2. 3. 4. 5.
References
1. 2.