7.5
High
CVE-2024-21484 Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or…
Description
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| jsrsasign 11.0 | earliest → < 11.0.0 | 11.0.0 |
| org.webjars.npm:jsrsasign | Versions not published | |
| org.webjars.bowergithub.kjur:jsrsasign | Versions not published | |
| org.webjars.bower:jsrsasign | Versions not published |
Other CVEs of jsrsasign
The 8 CVEs of jsrsasign →
CVE-2026-4603
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL…
5.9
Medium
CVE-2026-4601
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…
8.7
High
CVE-2026-4599
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing…
9.1
Critical
CVE-2026-4598
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in…
7.5
High