Threats tagged 'ghsa-4642-5mcj-2rqw'

The node-forge library's function asn1.oidToDer() improperly encoded Object Identifier (OID) strings with out-of-range first arcs, causing them to be encoded as different, trusted OIDs. This flaw was an incomplete fix of a previous vulnerability and affected versions prior to 1.4.1. The issue was fixed in version 1.4.1 by rejecting out-of-range first arcs and correctly encoding the first subidentifier. The vulnerability allows an attacker to cause applications that accept untrusted OID strings and encode them with node-forge to emit a different OID than intended, potentially bypassing string-based OID checks. There is no impact on confidentiality or availability, and DER parsing is unaffected.