[ Reason ]
node-node-forge signature verification code is lenient in checking the digest
algorithm structure. This can allow a crafted structure that steals padding
bytes and uses unchecked portion of the PKCS#1 encoded message to forge a
signature when a low public exponent is being used. The issue has been
addressed in `node-forge` version 1.3.0.

[ Impact ]
medium vulnerability

[ Tests ]
New test added

[ Risks ]
Low risk, test passed

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

[ Changes ]
Better checks

[ Other info ]
Upstream patch applied without any change

Cheers,
Yadd

Control: tags -1 + confirmed

Please go ahead.

Regards,

Adam

package release.debian.org
tags 1008153 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: node-node-forge
Version: 0.10.0~dfsg-3+deb11u1

Explanation: fix signature verification issues [CVE-2022-24771 CVE-2022-24772 CVE-2022-24773]

package release.debian.org
tags 1008153 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: node-node-forge
Version: 0.10.0~dfsg-3+deb11u1

Explanation: fix signature verification issues [CVE-2022-24771 CVE-2022-24772 CVE-2022-24773]

(re-sending with fixed bug numbers)

Hi,

The updates discussed in these bugs were included in today's bullseye
point release.

Regards,

Adam