CVE-2020-14967

An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts it decrypts modified ciphertexts without error. An attacker might prepend these bytes with the...

@accordproject/cicero-cli (>=0.3.4, <=0.8.0), @accordproject/cicero-common (>=0.3.4, <=0.3.17) +117 more potentially affected by CVE-2020-14967 via jsrsasign (>=8.0.0, <=8.0.17)

jsrsasign NPM version =8.0.0, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.0.61-20180603194157, =0.0.61-20180603194157, =0.0.61-20180603194157, =0.14.7, =1.0.0-beta.0, =1.0.0-beta.0, =0.2.0, =0.4.1, =7.16.0-snapshot-1588249669640, =10.4.0-snapshot-1623305489836 and more Source cves: CVE-2020-14967...

CVE-2020-14967

CVE-2020-14967 affects the jsrsasign package for Node.js prior to version 8.0.18. The RSA PKCS1 v1.5 decryption path does not detect ciphertext modifications when zeros are prepended to ciphertexts, allowing modified ciphertexts to be decrypted without error and potentially triggering memory corr...