GHSA-5w25-hxp5-h8c9

Source

https://github.com/advisories/GHSA-5w25-hxp5-h8c9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-5w25-hxp5-h8c9/GHSA-5w25-hxp5-h8c9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5w25-hxp5-h8c9

Withdrawn

2026-01-23T22:42:00Z

Published

2021-06-21T17:12:13Z

Modified

2026-02-03T03:08:04Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Duplicate Advisory: Improper Verification of Cryptographic Signature

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7r96-8g3x-g36m. This link is maintained to preserve external references.

Original Description

tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the verifyWithMessage method of tEnvoyNaClSigningKey always returns true for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In tenvoy.js under the verifyWithMessage method definition within the tEnvoyNaClSigningKey class, ensure that the return statement call to this.verify ends in .verified.

Database specific

{
    "cwe_ids":  [
        "CWE-347"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-06-17T18:47:52Z",
    "nvd_published_at":  "2021-06-16T01:15:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

npm / tenvoy

Package

Name: tenvoy; View open source insights on deps.dev
Purl: pkg:npm/tenvoy

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7.0.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-5w25-hxp5-h8c9/GHSA-5w25-hxp5-h8c9.json"