Signatures are mistakenly recognized to be valid in jsrsasign

GHSA-h87q-g2wp-47pj

Published Feb 9, 2022 · Modified Feb 15, 2022

Description

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-30246
WEB https://github.com/kjur/jsrsasign/issues/478
WEB https://github.com/kjur/jsrsasign/releases/tag/10.1.13
WEB https://github.com/kjur/jsrsasign/releases/tag/10.2.0
WEB https://kjur.github.io/jsrsasign

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes