7.5
Élevée
CVE-2024-21484 Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or…
Description
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| jsrsasign 11.0 | premières → < 11.0.0 | 11.0.0 |
| org.webjars.npm:jsrsasign | Versions non publiées | |
| org.webjars.bowergithub.kjur:jsrsasign | Versions non publiées | |
| org.webjars.bower:jsrsasign | Versions non publiées |
Références
- security.snyk.io security.snyk.io
- security.snyk.io security.snyk.io
- security.snyk.io security.snyk.io
- security.snyk.io security.snyk.io
- github.com github.com
- github.com github.com
- people.redhat.com people.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de jsrsasign
Les 8 CVE de jsrsasign →
CVE-2026-4603
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL…
5.9
Moyenne
CVE-2026-4601
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…
8.7
Élevée
CVE-2026-4599
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing…
9.1
Critique
CVE-2026-4598
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in…
7.5
Élevée