« Volver al listado

CVE-2026-23967

Estado: AnalizadaAlta (7.5)—

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library prior to version 0.3.14. An attacker can derive a new valid signature for a previously signed message from an existing signature. Version 0.3.14 patches the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CVE en librería criptográfica expuesta en red (AV:N, PR:N, UI:N); permite falsificar firmas SM2 (malleable signatures → T1553.006 forja de código/datos). Afecta integridad de firmas digitales.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Registry PermissionsNetwork SegmentationLimit Access to Resource Over NetworkFilter Network Traffic

Tecnologías afectadas (1)

Juneandgreen — Sm-crypto

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-23967",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23967",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-22T16:03:25.576580Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "JuneAndGreen",
          "product": "sm-crypto",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.3.14"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-22T03:15:47.167",
  "references": [
    {
      "url": "https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-qv7w-v773-3xqm",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library prior to version 0.3.14. An attacker can derive a new valid signature for a previously signed message from an existing signature. Version 0.3.14 patches the issue."
    },
    {
      "lang": "es",
      "value": "sm-crypto proporciona implementaciones de JavaScript de los algoritmos criptográficos chinos SM2, SM3 y SM4. Existe una vulnerabilidad de maleabilidad de firma en la lógica de verificación de firma SM2 de la librería sm-crypto anterior a la versión 0.3.14. Un atacante puede derivar una nueva firma válida para un mensaje previamente firmado a partir de una firma existente. La versión 0.3.14 corrige el problema."
    }
  ],
  "lastModified": "2026-06-17T10:22:22.200",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:juneandgreen:sm-crypto:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "902F9DFD-B5BC-4BF4-9AF2-CB42F616B3D4",
              "versionEndExcluding": "0.3.14"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}