CVE-2021-32685
Last modified
CVE-2021-32685 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. EPSS estimates a 0.66% chance of exploitation in the next 30 days.
Description
tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In `tenvoy.js` under the `verifyWithMessage` method definition within the `tEnvoyNaClSigningKey` class, ensure that the return statement call to `this.verify` ends in `.verified`.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Togatech | Tenvoy | < 7.0.3 |
References
- https://github.com/TogaTech/tEnvoy/commit/a121b34a45e289d775c62e58841522891dee686bPatch, Third Party Advisory
- https://github.com/TogaTech/tEnvoy/releases/tag/v7.0.3Release Notes, Third Party Advisory
- https://github.com/TogaTech/tEnvoy/security/advisories/GHSA-7r96-8g3x-g36mThird Party Advisory
- https://github.com/TogaTech/tEnvoy/commit/a121b34a45e289d775c62e58841522891dee686bPatch, Third Party Advisory
- https://github.com/TogaTech/tEnvoy/releases/tag/v7.0.3Release Notes, Third Party Advisory
- https://github.com/TogaTech/tEnvoy/security/advisories/GHSA-7r96-8g3x-g36mThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-32685?
How severe is CVE-2021-32685?
How do I fix CVE-2021-32685?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-32679Nextcloud Server is a Nextcloud package that handles data st…8.8
- CVE-2021-32680Nextcloud Server is a Nextcloud package that handles data st…3.3
- CVE-2021-32681Wagtail is an open source content management system built on…5.4
- CVE-2021-32682elFinder is an open-source file manager for web, written in …9.8
- CVE-2021-32683wire-webapp is the web version of Wire, an open-source messe…6.1
- CVE-2021-32684magento-scripts contains scripts and configuration used by C…5.5
- CVE-2021-32686PJSIP is a free and open source multimedia communication lib…5.9
- CVE-2021-32687Redis is an open source, in-memory database that persists on…7.5
- CVE-2021-32688Nextcloud Server is a Nextcloud package that handles data st…8.8
- CVE-2021-32689Nextcloud Talk is a fully on-premises audio/video and chat c…6.5
- CVE-2021-32690Helm is a tool for managing Charts (packages of pre-configur…8.6
- CVE-2021-32691Apollos Apps is an open source platform for launching church…9.8
Are you affected by CVE-2021-32685?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST