Описание
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
A flaw was found in Poppler. For signatures with non-empty encapsulated content, typically adbe.pkcs7.sha1, it would only compare hash values, and SignatureValue was never checked within SignerInfo. This issue could lead to signature forgeries.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | poppler | Fix deferred | ||
| Red Hat Enterprise Linux 7 | poppler | Fix deferred | ||
| Red Hat Enterprise Linux 8 | poppler | Fix deferred | ||
| Red Hat Enterprise Linux 9 | poppler | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the ...
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
EPSS
4.3 Medium
CVSS3