Niedrig 3.7Linux-Server
CVE-2026-118774
node-forge: node-forge: Signature policy bypass via improper certificate parameter selection
node-forge
### Summary When verifying a certificate, node-forge chose the RSA padding scheme (PKCS#1 v1.5 or RSASSA-PSS) and PSS parameters from the issuer certificate's own signature algorithm instead of the certificate being verified. A certificate labeled as signed with RSASSA-PSS could pass `verifyCertificateChain()` with a PKCS#1 v1.5 signature. Fixed in node-forge 1.4.1. ### Details `certificate.verify(child)` in `lib/x509.js` hashes the child's TBSCertificate with the digest of…
29. Okt 2026
Original bei Red Hat öffnen