CVE-2021-32685

Katalog CVE

CVSS 9.8 · Critical EPSS 0,66%

Kerentanan Improper Verification of Cryptographic Signature pada togatech tenvoy. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In `tenvoy.js` under the `verifyWithMessage` method definition within the `tEnvoyNaClSigningKey` class, ensure that the return statement call to `this.verify` ends in `.verified`.

Rincian

Terbit di NVD

16 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/TogaTech/tEnvoy/commit/a121b34a45e289d775c62e58841522891dee686b patch · advisory pihak ketiga
• https://github.com/TogaTech/tEnvoy/releases/tag/v7.0.3 release notes · advisory pihak ketiga
• https://github.com/TogaTech/tEnvoy/security/advisories/GHSA-7r96-8g3x-g36m advisory pihak ketiga