cve/2023/CVE-2023-46234.md

### [CVE-2023-46234](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46234)
![](https://img.shields.io/static/v1?label=Product&message=browserify-sign&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3E%3D%202.6.0%2C%20%3C%3D%204.2.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-347%3A%20Improper%20Verification%20of%20Cryptographic%20Signature&color=brighgreen)

### Description

browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds
- https://github.com/seal-community/patches