Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SDK-3311] Added protection against CVE-2022-21449 #579

Merged
merged 6 commits into from May 5, 2022
Merged

[SDK-3311] Added protection against CVE-2022-21449 #579

merged 6 commits into from May 5, 2022

Conversation

poovamraj
Copy link
Contributor

Changes

This PR will implement defence against CVE-2022-21449 by validating the signatures structure so that

  • The entire signature is not filled with zero
  • The value of R and S are not zero
  • The value of R and S are not less than 1 compared to the ECDSA Algorithm's order

References

Testing

We have added Unit Tests to check for the vulnerable signature. We have ensured the logic we use to validate the signature is also unit tested

  • This change adds test coverage
  • This change has been tested on the latest version of Java or why not

@poovamraj poovamraj requested a review from a team as a code owner May 3, 2022 14:06
@poovamraj poovamraj added this to the v3-Next milestone May 3, 2022
@lbalmaceda
Copy link
Contributor

LGTM

@poovamraj poovamraj merged commit 34caf1f into master May 5, 2022
@poovamraj poovamraj modified the milestones: v3-Next, 3.19.2 May 5, 2022
@poovamraj poovamraj mentioned this pull request May 5, 2022
Merged
@jimmyjames jimmyjames deleted the psychic-signature-vulnerability-protection branch October 15, 2022 02:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@stevehobbsdev stevehobbsdev stevehobbsdev approved these changes

Assignees
No one assigned
Labels
CH: Security review:large Large review
Projects
None yet
Milestone
3.19.2
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@poovamraj @lbalmaceda @stevehobbsdev