npm/jsrsasign CVE-2020-14966: high 7.5, EPSS 1.13%

ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign

Action: Upgrade jsrsasign to 8.0.19 or later.

npm i jsrsasign@8.0.19

Affected

Fixed versions

Sources

• osv: GHSA-p8c3-7rj8-q963
• https://github.com/kjur/jsrsasign/security/advisories/GHSA-p8c3-7rj8-q963
• https://nvd.nist.gov/vuln/detail/CVE-2020-14966
• https://github.com/kjur/jsrsasign/issues/437
• https://github.com/kjur/jsrsasign/commit/6087412d072a57074d3c4c1b40bdde0460d53a7f
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14966
• https://github.com/kjur/jsrsasign
• https://github.com/kjur/jsrsasign/releases/tag/8.0.17
• https://github.com/kjur/jsrsasign/releases/tag/8.0.18
• https://kjur.github.io/jsrsasign
• https://kjur.github.io/jsrsasign/api/symbols/ASN1HEX.html#.checkStrictDER
• https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.ECDSA.html
• https://security.netapp.com/advisory/ntap-20200724-0001
• https://vuldb.com/?id.157123
• https://www.npmjs.com/package/jsrsasign

CVE-2020-14966 · published 2020-06-26T16:54:15Z · modified 2023-11-08T04:02:28.073703Z · JSON