← Back to CVE List

CVE-2021-32685

Published: 2021-06-16T01:15Z
Last Modified: 2024-11-21T06:07Z
Source: MITRE CVE List
License: MITRE-CVE-TOS
tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In `tenvoy.js` under the `verifyWithMessage` method definition within the `tEnvoyNaClSigningKey` class, ensure that the return statement call to `this.verify` ends in `.verified`. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt