Skip to content

v13.3.2

Latest
Latest

Choose a tag to compare

View all tags
@MasterKale MasterKale released this 24 Jun 05:13
v13.3.2
803d1da
This commit was signed with the committer’s verified signature.
MasterKale Matthew Miller
SSH Key Fingerprint: Jvn6a+nBf2s5VcRr+Xw7UKKWTc32Fl0Ol/uC7cKTI3k
Verified
Learn about vigilant mode.

This update fixes a CVSS v4 Low (2.0) security vulnerability identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

  • [server] Fixed an issue with verifyRegistrationResponse() allowing a maliciously-crafted attestation statement's x5c to contain a self-signed "root certificate" instead of chaining back to an RP-specified trust anchor (GHSA-6hxq-p678-4hr2)
Assets 2
Loading