Aller au contenu
en Se connecter
7.4 Élevée

CVE-2026-4600 Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via…

Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.

Produits et versions touchés

Produit Versions touchées Corrigé en
jsrsasign 11.1 premières → < 11.1.1 11.1.1
org.webjars.npm:jsrsasign Versions non publiées
Migration Toolkit for Virtualization 2.1 1779139872 premières → < 1779139872 1779139872
Migration Toolkit for Virtualization 2.9 1778927462 premières → < 1778927462 1778927462
Red Hat Quay 3.12 1775253092 premières → < 1775253092 1775253092
Red Hat Quay 3.15 1775169219 premières → < 1775169219 1775169219
Red Hat Quay 3.16 1779204086 premières → < 1779204086 1779204086
Red Hat Quay 3.1 1775169155 premières → < 1775169155 1775169155
Red Hat Quay 3.9 1775169218 premières → < 1775169218 1775169218
Afficher l’autre branche
Produit Versions touchées Corrigé en
Red Hat Quay 3.10 1775169155 premières → < 1775169155 1775169155

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de jsrsasign

Les 8 CVE de jsrsasign →
CVE-2026-4603 Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL… 5.9 Moyenne CVE-2026-4601 Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the… 8.7 Élevée CVE-2026-4599 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing… 9.1 Critique CVE-2026-4598 Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in… 7.5 Élevée
Suivre cette CVE