Description
RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.
Recommendation
Update the jsrsasign package to the latest compatible version. Followings are version details:
- Affected version(s): < 11.0.0
- Patched version(s): 11.0.0
References
Related Issues
- RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign - CVE-2020-14967
- RSA signature validation vulnerability on maleable encoded message in jsrsasign - CVE-2021-30246
- RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign - CVE-2020-14968
- Firebase vulnerable to CRSF attack - CVE-2024-4128
- Tags:
- npm
- jsrsasign
Anything's wrong? Let us know Last updated on February 27, 2024