Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
14 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.
Recommended action: Upgrade to 11.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.
Recommended action: Upgrade to 11.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.
Recommended action: Upgrade to 11.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
Recommended action: Upgrade to 11.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.
Recommended action: Upgrade to 11.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.
Recommended action: Upgrade to 11.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability. Patches update to jsrsasign 11.0.0. Workarounds Find and replace RSA and RSAOAEP decryption with other crypto library. References https://people.redhat.com/~hkario/marvin/ https://github.com/kjur/jsrsasign/issues/598 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21484
Recommended action: Upgrade to 11.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Jsrsasign supports JWS(JSON Web Signatures) and JWT(JSON Web Token) validation. However JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. For example, even if a string of non Base64URL encoding characters such as !@$% or \11 is inserted into a valid JWS or JWT signature value string, it will still be a valid JWS or JWT signature by mistake. When jsrsasign's JWS or JWT validation is used in OpenID connect or OAuth2, this vulnerability will affect to authentication or authorization. By our internal assessment, CVSS 3.1 score will be 8.6. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Patches Users validate JWS or JWT signatures should upgrade to 10.5.25. Workarounds Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method. ACKNOWLEDGEMENT Thanks to Adi Malyanker and Or David for this vulnerability report. Also thanks for Snyk…
Recommended action: Upgrade to 10.5.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
Recommended action: Upgrade to 10.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Vulnerable jsrsasign will accept RSA signature with improper PKCS#1.5 padding. Decoded RSA signature value consists following form: 01(ff...(8 or more ffs)...ff)00[ASN.1 OF DigestInfo] Its byte length must be the same as RSA key length, however such checking was not sufficient. To make crafted message for practical attack is very hard. Patches Users validating RSA signature should upgrade to 10.2.0 or later. Workarounds There is no workaround. Not to use RSA signature validation in jsrsasign. ACKNOWLEDGEMENT Thanks to Daniel Yahyazadeh @yahyazadeh for reporting and analyzing this vulnerability.
Recommended action: Upgrade to 10.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact ECDSA side-channel attack named Minerava have been found and it was found that it affects to jsrsasign. Execution time of thousands signature generation have been observed then EC private key which is scalar value may be recovered since point and scalar multiplication time depends on bits of scalar. In jsrsasign 8.0.13 or later, execution time of EC point and scalar multiplication is almost constant and fixed for the issue. - Minerva is one of timing attack or side channel attack for EC. - If you don't use ECDSA class, you are not affected the vulnerability. - The vulnerability is that attacker may guess private key by checking processing time of EC key generation or ECDSA signing. - The cause issue is that point multiplication processing time in ECDSA signing is depends on private key value. - After 8.0.13, processing time of point multiplication in ECDSA signing have become constant for key value in theory. Patches Users using ECDSA signature generation should upgrade to…
Recommended action: Upgrade to 8.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Jsrsasign supports ECDSA signature validation which signature value is represented by ASN.1 DER encoding. This vulnerablity may accept a wrong ASN.1 DER encoded ECDSA signature such as: - wrong multi-byte ASN.1 length of TLV (ex. 0x820045 even though 0x45 is correct) - prepending zeros with ASN.1 INTEGER value (ex. 0x00000123 even though 0x0123 is correct) - appending zeros to signature of ASN.1 TLV (ex. 0x3082....1fbc000000 even though 0x3082....1fbc, appending zeros are ignored.) This vulnerability was fixed by strict ASN.1 DER checking. Here is an assessment of this vulnerability: - If you are not use ECDSA signature validation, this vulnerability is not affected. - Not ASN.1 format signature like just concatenation of R and S value is not affected such as Bitcoin. - This vulnerability is affected to all ECC curve parameters. - Risk to accept a forged or crafted message to be signed is low. - Risk to raise memory corruption is low since jsrsasign uses BigInteger class. -…
Recommended action: Upgrade to 8.0.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Jsrsasign supports RSA PKCS#1 v1.5 (i.e. RSAES-PKCS1-v15) and RSA-OAEP encryption and decryption. Its encrypted message is represented as BigInteger. When there is a valid encrypted message, a crafted message with prepending zeros can be decrypted by this vulnerability. - If you don't use RSA PKCS1-v15 or RSA-OAEP decryption, this vulnerability is not affected. - Risk to forge contents of encrypted message is very low. - Risk to raise memory corruption is low since jsrsasign uses BigInteger class. Patches Users using RSA PKCS1-v15 or RSA-OAEP decryption should upgrade to 8.0.18. Workarounds Reject RSA PKCS1-v15 or RSA-OAEP encrypted message with unnecessary prepending zeros. References https://nvd.nist.gov/vuln/detail/CVE-2020-14967 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14967 https://vuldb.com/?id.157124 https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.Cipher.html#.decrypt https://github.com/kjur/jsrsasign/issues/439
Recommended action: Upgrade to 8.0.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Jsrsasign can verify RSA-PSS signature which value can expressed as BigInteger. When there is a valid RSA-PSS signature value, this vulnerability is also accept value with prepending zeros as a valid signature. - If you are not use RSA-PSS signature validation, this vulnerability is not affected. - Risk to accept a forged or crafted message to be signed is low. - Risk to raise memory corruption is low since jsrsasign uses BigInteger class. Patches Users using RSA-PSS signature validation should upgrade to 8.0.17. Workarounds Reject RSA-PSS signatures with unnecessary prepending zeros. References https://github.com/kjur/jsrsasign/security/advisories/GHSA-q3gh-5r98-j4h3 https://github.com/kjur/jsrsasign/issues/438 https://nvd.nist.gov/vuln/detail/CVE-2020-14968 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14968 https://vuldb.com/?id.157125…
Recommended action: Upgrade to 8.0.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.