Description
RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.
Recommendation
Update the jsrsasign package to the latest compatible version. Followings are version details:
- Affected version(s): < 11.0.0
- Patched version(s): 11.0.0
References
Could your website be exposed too?
SmartScanner can check your website for Marvin Attack of RSA and RSAOAEP decryption in jsrsasign and gives you actionable findings to investigate.
Start a free scanRelated Issues
- RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign - CVE-2020-14967
- jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations - CVE-2026-4603
- RSA signature validation vulnerability on maleable encoded message in jsrsasign - CVE-2021-30246
- RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign - CVE-2020-14968
You might also like:
See something that needs correcting? Let us knowUpdated February 27, 2024