Impact
A signature‑verification bypass (CWE‑347) accepts unsigned CMS messages as genuine.
Who is impacted?
– Any client that uses secon‑tool ≤ v1.2.1 to process inbound messages signed and encrypted using the GKV SECON security interface (Anlage 16)
– Deployments that gate submission at the transport layer (enrolled-sender certificate) are less exposed; the library-level defect remains, but the unauthenticated-outsider path is closed at the transport gate.
Consequence
– An attacker who knows the recipient’s public encryption certificate can inject arbitrary, unauthenticated payloads. The recipient treats the payload as if it were signed by a trusted sender.
Patches
Fixed versions: >= 1.2.2
What the fix does
– DefaultSubscriber now validates that the SignerInfo collection is non‑empty and throws an exception when it is not. This restores the mandatory “at least one signer” requirement stipulated by Anlage 16 §3.1.
Workarounds
-
Transport-level sender authentication – where the submission channel (e.g. an enrollment-gated GKV transport) gates delivery behind a sender certificate, an unauthenticated outsider cannot reach the verification path.
-
Pre‑validation – Reject any inbound CMS SignedData whose signerInfos set is empty before invoking secon‑tool.
References
GKV - Anlage 16 -SECON Security Schnittstelle
Machine Spirits Advisory MS-SECON-d8f902 https://machinespirits.com/advisory/d8f902/
Impact
A signature‑verification bypass (CWE‑347) accepts unsigned CMS messages as genuine.
Who is impacted?
– Any client that uses secon‑tool ≤ v1.2.1 to process inbound messages signed and encrypted using the GKV SECON security interface (Anlage 16)
– Deployments that gate submission at the transport layer (enrolled-sender certificate) are less exposed; the library-level defect remains, but the unauthenticated-outsider path is closed at the transport gate.
Consequence
– An attacker who knows the recipient’s public encryption certificate can inject arbitrary, unauthenticated payloads. The recipient treats the payload as if it were signed by a trusted sender.
Patches
Fixed versions: >= 1.2.2
What the fix does
– DefaultSubscriber now validates that the SignerInfo collection is non‑empty and throws an exception when it is not. This restores the mandatory “at least one signer” requirement stipulated by Anlage 16 §3.1.
Workarounds
Transport-level sender authentication – where the submission channel (e.g. an enrollment-gated GKV transport) gates delivery behind a sender certificate, an unauthenticated outsider cannot reach the verification path.
Pre‑validation – Reject any inbound CMS
SignedDatawhosesignerInfosset is empty before invokingsecon‑tool.References
GKV - Anlage 16 -SECON Security Schnittstelle
Machine Spirits Advisory MS-SECON-d8f902 https://machinespirits.com/advisory/d8f902/