Digidoc4
Monthly
Improper cryptographic signature verification in Estonian RIA's libdigidocpp core library and its consumer applications - DigiDoc4, DigiDoc for Android, and DigiDoc for iOS - enables bypassing of XAdES signature validity checks through unhandled exceptional conditions during BDOC container parsing. Affected versions span libdigidocpp 4.1.0-4.2.0, DigiDoc4 4.7.0-4.8.1, DigiDoc Android 2.7.0-2.7.1, and DigiDoc iOS 2.8.0, all of which have vendor-released patches. A proof-of-concept is indicated by the CVSS 4.0 E:P exploit maturity modifier, though no active exploitation has been confirmed and this CVE is not listed in CISA KEV.
Improper cryptographic signature verification in Estonian RIA's libdigidocpp core library and its consumer applications - DigiDoc4, DigiDoc for Android, and DigiDoc for iOS - enables bypassing of XAdES signature validity checks through unhandled exceptional conditions during BDOC container parsing. Affected versions span libdigidocpp 4.1.0-4.2.0, DigiDoc4 4.7.0-4.8.1, DigiDoc Android 2.7.0-2.7.1, and DigiDoc iOS 2.8.0, all of which have vendor-released patches. A proof-of-concept is indicated by the CVSS 4.0 E:P exploit maturity modifier, though no active exploitation has been confirmed and this CVE is not listed in CISA KEV.