ECDSA signature vulnerability of Minerva timing attack in jsrsasign

Description

ECDSA side-channel attack named Minerava have been found and it was found that it affects to jsrsasign.

Execution time of thousands signature generation have been observed then EC private key which is scalar value may be recovered since point and scalar multiplication time depends on bits of scalar. In jsrsasign 8.0.

Recommendation

Update the jsrsasign package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.0.0, < 8.0.13
• Patched version(s): 8.0.13

References

• GHSA-g753-jx37-7xwh
• minerva.crocs.fi.muni.cz
• www.npmjs.com
• snyk.io
• CWE-362

Related Issues

• ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign - CVE-2020-14966
• cookie-signature Timing Attack - CVE-2016-1000236
• JWS and JWT signature validation vulnerability with special characters - CVE-2022-25898
• RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign - CVE-2020-14968

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

jsrsasign