GHSA-5W25-HXP5-H8C9严重已审查已撤回

Duplicate Advisory: Improper Verification of Cryptographic Signature

OSV 1.4.0 · github-reviewed · 修改于 2026-01-24 06:42

发布时间

2021-06-22 01:12

GitHub 审查时间

2021-06-18 02:47

NVD 发布时间

2021-06-16 09:15

源文件

advisories/github-reviewed/2021/06/GHSA-5w25-hxp5-h8c9/GHSA-5w25-hxp5-h8c9.json

该公告已于 2026-01-24 06:42 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7r96-8g3x-g36m. This link is maintained to preserve external references.

Original Description

tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the verifyWithMessage method of tEnvoyNaClSigningKey always returns true for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In tenvoy.js under the verifyWithMessage method definition within the tEnvoyNaClSigningKey class, ensure that the return statement call to this.verify ends in .verified.

受影响的软件包

npm

tenvoy

标识信息

别名 / CVE

无

CWE

CWE-347

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-5w25-hxp5-h8c9",
  "aliases": [],
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-7r96-8g3x-g36m. This link is maintained to preserve external references.\n\n## Original Description\ntEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In `tenvoy.js` under the `verifyWithMessage` method definition within the `tEnvoyNaClSigningKey` class, ensure that the return statement call to `this.verify` ends in `.verified`.",
  "summary": "Duplicate Advisory: Improper Verification of Cryptographic Signature",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.3"
            }
          ]
        }
      ],
      "package": {
        "name": "tenvoy",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2026-01-23T22:42:00Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "published": "2021-06-21T17:12:13Z",
  "withdrawn": "2026-01-23T22:42:00Z",
  "references": [
    {
      "url": "https://github.com/TogaTech/tEnvoy/security/advisories/GHSA-7r96-8g3x-g36m",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32685",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/TogaTech/tEnvoy/commit/a121b34a45e289d775c62e58841522891dee686b",
      "type": "WEB"
    },
    {
      "url": "https://github.com/TogaTech/tEnvoy/releases/tag/v7.0.3",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": "2021-06-16T01:15:00Z",
    "github_reviewed_at": "2021-06-17T18:47:52Z"
  }
}