7.7
Élevée
CVE-2022-25898 The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or…
Description
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| jsrsasign 10.5 | premières → < 10.5.25 | 10.5.25 |
Références
- snyk.io snyk.io
- snyk.io snyk.io
- snyk.io snyk.io
- snyk.io snyk.io
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de jsrsasign
Les 8 CVE de jsrsasign →
CVE-2026-4603
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL…
5.9
Moyenne
CVE-2026-4601
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…
8.7
Élevée
CVE-2026-4599
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing…
9.1
Critique
CVE-2026-4598
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in…
7.5
Élevée