Skip to content
fr Sign in
8.7 High

CVE-2026-4601 Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…

Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

Affected products and versions

Product Affected versions Fixed in
Migration Toolkit for Virtualization 2.1 1779139872 earliest → < 1779139872 1779139872
Migration Toolkit for Virtualization 2.9 1778927462 earliest → < 1778927462 1778927462
Red Hat Quay 3.12 1775253092 earliest → < 1775253092 1775253092
Red Hat Quay 3.15 1775169219 earliest → < 1775169219 1775169219
Red Hat Quay 3.16 1779204086 earliest → < 1779204086 1779204086
Red Hat Quay 3.1 1775169155 earliest → < 1775169155 1775169155
Red Hat Quay 3.9 1775169218 earliest → < 1775169218 1775169218
jsrsasign 11.1 earliest → < 11.1.1 11.1.1
Red Hat Quay 3.10 1775169155 earliest → < 1775169155 1775169155
Show the other branch
Product Affected versions Fixed in
org.webjars.npm:jsrsasign Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Migration Toolkit for Virtualization 2.1

The 8 CVEs of Migration Toolkit for Virtualization 2.1 →
CVE-2026-4800 The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same… 8.1 High CVE-2026-4926 Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace… 7.5 High CVE-2026-4599 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing… 9.1 Critical CVE-2026-4598 Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in… 7.5 High
Track this CVE