oviva epa4all-client ECDSA Signature Verification Vulnerability in SignedPublicKeysTrustValidator

A vulnerability exists in the oviva epa4all-client Java library, specifically in versions prior to 1.2.1. The issue arises in the SignedPublicKeysTrustValidatorImpl.isTrusted() method, where the ECDSA signature verification improperly ignores the boolean result of the Signature.verify() call. Although the method conducts certificate chain validation, OCSP checks, and sets up the signature algorithm, it fails to verify if the signature actually corresponds. As a result, the method returns true for any structurally valid signature, creating a trust validation bypass.

Impact

This vulnerability allows for a bypass of ECDSA signature verification, enabling the acceptance of invalid signatures as valid. This could lead to unauthorized actions being performed or trusted entities being falsely validated.

Remediation

Users can upgrade to version 1.2.1 or later to address this vulnerability.