8.7
Élevée
CVE-2026-4601 Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…
Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Migration Toolkit for Virtualization 2.1 1779139872 | premières → < 1779139872 | 1779139872 |
| Migration Toolkit for Virtualization 2.9 1778927462 | premières → < 1778927462 | 1778927462 |
| Red Hat Quay 3.12 1775253092 | premières → < 1775253092 | 1775253092 |
| Red Hat Quay 3.15 1775169219 | premières → < 1775169219 | 1775169219 |
| Red Hat Quay 3.16 1779204086 | premières → < 1779204086 | 1779204086 |
| Red Hat Quay 3.1 1775169155 | premières → < 1775169155 | 1775169155 |
| Red Hat Quay 3.9 1775169218 | premières → < 1775169218 | 1775169218 |
| jsrsasign 11.1 | premières → < 11.1.1 | 11.1.1 |
| Red Hat Quay 3.10 1775169155 | premières → < 1775169155 | 1775169155 |
Afficher l’autre branche Masquer l’autre branche
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| org.webjars.npm:jsrsasign | Versions non publiées |
Références
- security.snyk.io security.snyk.io
- security.snyk.io security.snyk.io
- gist.github.com gist.github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Migration Toolkit for Virtualization 2.1
Les 8 CVE de Migration Toolkit for Virtualization 2.1 →
CVE-2026-4800
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same…
8.1
Élevée
CVE-2026-4926
Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace…
7.5
Élevée
CVE-2026-4599
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing…
9.1
Critique
CVE-2026-4598
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in…
7.5
Élevée