Published: 22/06/2020 Updated: 28/01/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

An issue exists in the jsrsasign package up to and including 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.

Vulnerable Product	Search on Vulmon	Subscribe to Product
jsrsasign project jsrsasign
netapp max data -

jsrsasign The 'jsrsasign' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA signing/validation, ASN1, PKCS#1/5/8 private/public key, X509 certificate, CRL, OCSP, CMS SignedData, TimeStamp, CAdES JSON Web Signature/Token/Key in pure JavaScript Public page is kjurgithubio/jsrsasign Your bugfix

jsrsasign The 'jsrsasign' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA signing/validation, ASN1, PKCS#1/5/8 private/public key, X509 certificate, CRL, OCSP, CMS SignedData, TimeStamp, CAdES JSON Web Signature/Token/Key in pure JavaScript Public page is kjurgithubio/jsrsasign Your bugfix an

CWE-347 https://github.com/kjur/jsrsasign/releases/tag/8.0.17 https://github.com/kjur/jsrsasign/releases/tag/8.0.18 https://www.npmjs.com/package/jsrsasign https://github.com/kjur/jsrsasign/issues/437 https://kjur.github.io/jsrsasign/https://security.netapp.com/advisory/ntap-20200724-0001/https://nvd.nist.gov https://github.com/astreiten/jsrsasign-mod

CVE-2020-14966

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect