CVE-2023-46234 is a medium-severity (CVSS 6.5) CWE-347 vulnerability in browserify-sign. A fix is available for browserify-sign — see the affected versions and patch details below.
browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
browserify-signnpmDescription
Summary
An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack.
Details
In dsaVerify function, it checks whether the value of the signature is legal by calling function checkValue, namely, whether r and s are both in the interval [1, q - 1]. However, the second line of the checkValue function wrongly checks the upper bound of the passed parameters, since the value of b.cmp(q) can only be 0, 1 and -1, and it can never be greater than q.
In this way, although the values of s cannot be 0, an attacker can achieve the same effect as zero by setting its value to q, and then send (r, s) = (1, q) to pass the verification of any public key.
Impact
All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability.
Fix PR:
Since the temporary private fork was deleted, here's a webarchive of the PR discussion and diff pages: PR webarchive.zip
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | browserify-sign | ≥ 2.6.0&&< 4.2.2 | 4.2.2npm install browserify-sign@4.2.2 |
Affected Products
browserify-signbrowserifydebian linuxdebianDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for browserify-sign, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update browserify-sign to 4.2.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-46234 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
An attacker could impact the integrity of a server when handling unknown input due to the lack of DSA verification, for example, pretending to be a legitimate user, gaining unauthorized access. Therefore, the impact for this vulnerability is important. Red Hat Fuse 7 uses browserify-sign as a transitive development…
No current mitigation is yet available for this flaw.Source: Red Hat security advisory for CVE-2023-46234 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Developer Hub 1.2 on RHEL 9 | rhdh/rhdh-hub-rhel9:1.2-154 | RHBA-2024:10184 |
Frequently Asked Questions
Is CVE-2023-46234 in your dependencies?
Find it across npm, including transitive dependencies.