GHSA-g8r3-5hwf-qp96
epa4all-client has a VAU Signature bypass
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.oviva.telematik:epa4all-client | < 1.2.1 | 1.2.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
In SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify(). The method performs certificate chain validation, OCSP check, and signature algorithm setup, but never checks whether the signature actually matches. For any structurally valid signature, it returns true.
### Patches
Patched in [#34](https://github.com/oviva-ag/epa4all-client/pull/34).
### Workarounds
None.
### Resources
- [MS-OVIVA-EPA4ALL-d76aec](https://www.machinespirits.com/advisory/d76aec/)
### Credits
[Machine Spirits](https://machinespirits.com) ([email protected])
- Dr. rer. nat. Simon Weber
- Dipl.-Inf. Volker Schönefeld
- Chiara Fliegner
References
External links from the advisory. They lead to third-party sites.