Security vulnerability in DigiDoc applications: impact and RIA’s response

DigiDoc applications contained a validation flaw that could, under certain conditions, cause the application to display an invalid digital signature as valid. According to RIA, the flaw did not technically make an invalid signature valid and did not allow an attacker to freely create a genuinely valid digital signature belonging to an arbitrary person. RIA is not aware of cases in which the vulnerability was abused, but cannot technically rule out all possible cases retrospectively.