@10yun/cv-mobile-ui (0.3.20), @accordproject/cicero-cli (>=0.3.4, <=0.8.0) +496 more potentially affected by CVE-2020-14966 via jsrsasign (>=4.8.2, <=8.0.18)

jsrsasign NPM version =4.8.2, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.0.61-20180603194157, =0.0.61-20180603194157, =0.0.61-20180603194157, =0.14.7, =2.0.1-alpha.0, =1.0.0-beta.0, =1.0.0-beta.0, =2.0.1-alpha.0, =1.0.0-beta.0, =1.2.1-alpha.0 and more Source cves: CVE-2020-14966 Source advisory:...

ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign

Impact Jsrsasign supports ECDSA signature validation which signature value is represented by ASN.1 DER encoding. This vulnerablity may accept a wrong ASN.1 DER encoded ECDSA signature such as: - wrong multi-byte ASN.1 length of TLV ex. 0x820045 even though 0x45 is correct - prepending zeros with...

@accordproject/cicero-cli (>=0.3.4, <=0.8.0), @accordproject/cicero-common (>=0.3.4, <=0.3.17) +117 more potentially affected by CVE-2020-14967 via jsrsasign (>=8.0.0, <=8.0.17)

jsrsasign NPM version =8.0.0, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.0.61-20180603194157, =0.0.61-20180603194157, =0.0.61-20180603194157, =0.14.7, =1.0.0-beta.0, =1.0.0-beta.0, =0.2.0, =0.4.1, =7.16.0-snapshot-1588249669640, =10.4.0-snapshot-1623305489836 and more Source cves: CVE-2020-14967...

RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign

Impact Jsrsasign supports RSA PKCS1 v1.5 i.e. RSAES-PKCS1-v15 and RSA-OAEP encryption and decryption. Its encrypted message is represented as BigInteger. When there is a valid encrypted message, a crafted message with prepending zeros can be decrypted by this vulnerability. - If you don't use RSA...

GHSA-XXXQ-CHMP-67G4 RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign

Impact Jsrsasign supports RSA PKCS1 v1.5 i.e. RSAES-PKCS1-v15 and RSA-OAEP encryption and decryption. Its encrypted message is represented as BigInteger. When there is a valid encrypted message, a crafted message with prepending zeros can be decrypted by this vulnerability. - If you don't use RSA...

@10yun/cv-mobile-ui (0.3.20), @accordproject/cicero-cli (>=0.3.4, <=0.8.0) +496 more potentially affected by CVE-2020-14968 via jsrsasign (>=4.8.2, <=8.0.16)

jsrsasign NPM version =4.8.2, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.0.61-20180603194157, =0.0.61-20180603194157, =0.0.61-20180603194157, =0.14.7, =2.0.1-alpha.0, =1.0.0-beta.0, =1.0.0-beta.0, =2.0.1-alpha.0, =1.0.0-beta.0, =1.2.1-alpha.0 and more Source cves: CVE-2020-14968 Source advisory:...

GHSA-Q3GH-5R98-J4H3 RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign

Impact Jsrsasign can verify RSA-PSS signature which value can expressed as BigInteger. When there is a valid RSA-PSS signature value, this vulnerability is also accept value with prepending zeros as a valid signature. - If you are not use RSA-PSS signature validation, this vulnerability is not...

Improper Verification of Cryptographic Signature

Overview Versions of jsrsasignprior to 8.0.17 fail to properly verify cryptographic signatures. Its RSASSA-PSS RSA-PSS implementation does not detect signature manipulation/modification by prepending '\0' bytes to a signature it accepts these modified signatures as valid. An attacker can abuse th...

Incorrect Signature Validation

jsrsasign uses an incorrect signature validation. It is possible because its RSASSA-PSS RSA-PSS implementation has a flaw which accepts manipulated/modified signatures as valid signatures by prepending '\0' bytes to a signature and also allows an attacker to send multiple valid signatures to...

jsrsasign package data forgery issue vulnerability

jsrsasign package is an open source encryption library from the Japanese software developer Kenji Urashima . A security vulnerability exists in jsrsasign package version 8.0.18 and earlier Node.js. No detailed vulnerability details are provided at this time...

jsrsasign package buffer overflow vulnerability (CNVD-2021-20284)

jsrsasign package is an open source encryption library from the Japanese software developer Kenji Urashima . A security vulnerability exists in jsrsasign package versions prior to 8.0.18 Node.js. An attacker could exploit this vulnerability to cause memory corruption...

jsrsasign package buffer overflow vulnerability

jsrsasign package is an open source encryption library from the Japanese software developer Kenji Urashima . A buffer overflow vulnerability exists in jsrsasign package versions prior to 8.0.17 Node.js, which can be exploited by an attacker to cause memory corruption...

CVE-2020-14967

An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts it decrypts modified ciphertexts without error. An attacker might prepend these bytes with the...

CVE-2020-14967

An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts it decrypts modified ciphertexts without error. An attacker might prepend these bytes with the...

CVE-2020-14968

An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS RSA-PSS implementation does not detect signature manipulation/modification by prepending '\0' bytes to a signature it accepts these modified signatures as valid. An attacker can abuse this behavior in an...

CVE-2020-14966

An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a...

CVE-2020-14966

An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a...

Memory corruption

An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts it decrypts modified ciphertexts without error. An attacker might prepend these bytes with the...

Design/Logic Flaw

An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a...

CVE-2020-14966

An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a...