Digidoc4
Monthly
Improper verification of cryptographic signatures across the DigiDoc suite lets an attacker craft a document carrying a forged XAdES signature that affected software displays as valid, undermining the integrity of electronically signed documents (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - pure integrity impact with no confidentiality or availability effect). The defect is reachable by unauthenticated remote attackers (PR:N) with no user privilege or special configuration, but exploitation still requires a relying party to validate the forged file with an unpatched build: libdigidocpp before 4.5.0, DigiDoc4 before 4.11.0, or DigiDoc for Android/iOS before 3.1.0. Vendor fixes are available per the ENISA-referenced disclosure and upstream PR; no public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Improper cryptographic signature verification in Estonian RIA's libdigidocpp core library and its consumer applications - DigiDoc4, DigiDoc for Android, and DigiDoc for iOS - enables bypassing of XAdES signature validity checks through unhandled exceptional conditions during BDOC container parsing. Affected versions span libdigidocpp 4.1.0-4.2.0, DigiDoc4 4.7.0-4.8.1, DigiDoc Android 2.7.0-2.7.1, and DigiDoc iOS 2.8.0, all of which have vendor-released patches. A proof-of-concept is indicated by the CVSS 4.0 E:P exploit maturity modifier, though no active exploitation has been confirmed and this CVE is not listed in CISA KEV.
Improper verification of cryptographic signatures across the DigiDoc suite lets an attacker craft a document carrying a forged XAdES signature that affected software displays as valid, undermining the integrity of electronically signed documents (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - pure integrity impact with no confidentiality or availability effect). The defect is reachable by unauthenticated remote attackers (PR:N) with no user privilege or special configuration, but exploitation still requires a relying party to validate the forged file with an unpatched build: libdigidocpp before 4.5.0, DigiDoc4 before 4.11.0, or DigiDoc for Android/iOS before 3.1.0. Vendor fixes are available per the ENISA-referenced disclosure and upstream PR; no public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Improper cryptographic signature verification in Estonian RIA's libdigidocpp core library and its consumer applications - DigiDoc4, DigiDoc for Android, and DigiDoc for iOS - enables bypassing of XAdES signature validity checks through unhandled exceptional conditions during BDOC container parsing. Affected versions span libdigidocpp 4.1.0-4.2.0, DigiDoc4 4.7.0-4.8.1, DigiDoc Android 2.7.0-2.7.1, and DigiDoc iOS 2.8.0, all of which have vendor-released patches. A proof-of-concept is indicated by the CVSS 4.0 E:P exploit maturity modifier, though no active exploitation has been confirmed and this CVE is not listed in CISA KEV.