browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack
Priority LOW 34CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 fixed, 16 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.
Summary
browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.
Why it matters now
EPSS 0.00563 47th percentileScored 2026-11-07
Fix Partial browserify-sign (npm): 4.2.2Red Hat: 1 advisoryRed Hat: 1 fixed, 16 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| browserify | browserify-sign | 2.6.0 – 4.2.1 | — | No fix listed | CNA |
| — | browserify-sign (npm) | 2.6.0 to before 4.2.2 | 4.2.2 | Patch available | GHSA-x9w5-v3q2-3rhw |
- browserify-sign Vendorbrowserify Affected 2.6.0 – 4.2.1 Fixed in — No fix listed CNA
- browserify-sign (npm) Vendor— Affected 2.6.0 to before 4.2.2 Fixed in 4.2.2 Patch available GHSA-x9w5-v3q2-3rhw
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:browserify:browserify-sign:*:*:*:*:*:node.js:*:* | before 4.2.2 | Vulnerable | browserify |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Debian |
- cpe:2.3:a:browserify:browserify-sign:*:*:*:*:*:node.js:*:* Versions before 4.2.2 Vulnerable ·browserify
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-x9w5-v3q2-3rhw browserify-sign (npm) Fixed in 4.2.2 Advisory →
Red Hat 1 advisory
- RHSA-2023:6180 Released 2023-10-30 · Red Hat rating ImportantRed Hat OpenShift distributed tracing 2.9.0 containers security update
- Red Hat OpenShift distributed tracing 2.9 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +15
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2 | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Certification for Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat Developer Hub 1.2 for RHEL 9 | Fixed | — |
Not affected: 15 products
- Logging Subsystem for Red Hat OpenShift
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2
- Red Hat Decision Manager 7
- Red Hat Developer Hub 1.2 for RHEL 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Integration Camel K 1
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift GitOps
- Red Hat Openshift Data Foundation 4
- Red Hat Process Automation 7
- Red Hat Satellite 6
- Red Hat build of Apicurio Registry 2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-46234
- 2026-10-03 Alias added: GHSA-x9w5-v3q2-3rhw
References
Advisory 5
- https://github.com/browserify/browserify-sign/security/advisories/GHSA-x9w5-v3q2-3rhw
- https://github.com/browserify/browserify-sign/commit/85994cd6348b50f2fd1b73c54e20881416f44a30
- https://lists.debian.org/debian-lts-announce/2023/10/msg00040.html
- https://www.debian.org/security/2023/dsa-5539
- https://nvd.nist.gov/vuln/detail/CVE-2023-46234
Other 5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/
- https://github.com/browserify/browserify-sign
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ
Sources
- CVE-2023-46234 · CVE Program
- CVE-2023-46234 · NVD
- FIRST EPSS
- GHSA-x9w5-v3q2-3rhw · GitHub Advisory Database · CC BY 4.0
- CVE-2023-46234 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences