Digidoc Android
Monthly
Improper verification of cryptographic signatures across the DigiDoc suite lets an attacker craft a document carrying a forged XAdES signature that affected software displays as valid, undermining the integrity of electronically signed documents (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - pure integrity impact with no confidentiality or availability effect). The defect is reachable by unauthenticated remote attackers (PR:N) with no user privilege or special configuration, but exploitation still requires a relying party to validate the forged file with an unpatched build: libdigidocpp before 4.5.0, DigiDoc4 before 4.11.0, or DigiDoc for Android/iOS before 3.1.0. Vendor fixes are available per the ENISA-referenced disclosure and upstream PR; no public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Improper verification of cryptographic signatures across the DigiDoc suite lets an attacker craft a document carrying a forged XAdES signature that affected software displays as valid, undermining the integrity of electronically signed documents (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - pure integrity impact with no confidentiality or availability effect). The defect is reachable by unauthenticated remote attackers (PR:N) with no user privilege or special configuration, but exploitation still requires a relying party to validate the forged file with an unpatched build: libdigidocpp before 4.5.0, DigiDoc4 before 4.11.0, or DigiDoc for Android/iOS before 3.1.0. Vendor fixes are available per the ENISA-referenced disclosure and upstream PR; no public exploit code has been identified at time of analysis, and no active exploitation is confirmed.