jsrsasign project jsrsasign vulnerabilities and exploits

(subscribe to this query)

Versions of the package jsrsasign prior to 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the malicious user to h...

Jsrsasign Project Jsrsasign

The package jsrsasign prior to 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT si...

Jsrsasign Project Jsrsasign

An issue exists in the jsrsasign package up to and including 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verifi...

Jsrsasign Project Jsrsasign Netapp Max Data -

2 Github repositories

An issue exists in the jsrsasign package prior to 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend...

Jsrsasign Project Jsrsasign Netapp Max Data -

2 Github repositories

An issue exists in the jsrsasign package prior to 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending '\0' bytes to a signature (it accepts these modified signatures as valid). An attacker can abu...

Jsrsasign Project Jsrsasign Netapp Max Data -

2 Github repositories

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook