CVE-2020-14966
1 advisory.
npm/jsrsasign CVE-2020-14966: high 7.5
ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign
Action: Upgrade jsrsasign to 8.0.19 or later.
npm i jsrsasign@8.0.19Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 8.0.19 | - |
Fixed versions
| 8.0.19 |
Sources
- osv: GHSA-p8c3-7rj8-q963
- https://github.com/kjur/jsrsasign/security/advisories/GHSA-p8c3-7rj8-q963
- https://nvd.nist.gov/vuln/detail/CVE-2020-14966
- https://github.com/kjur/jsrsasign/issues/437
- https://github.com/kjur/jsrsasign/commit/6087412d072a57074d3c4c1b40bdde0460d53a7f
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14966
- https://github.com/kjur/jsrsasign
- https://github.com/kjur/jsrsasign/releases/tag/8.0.17
- https://github.com/kjur/jsrsasign/releases/tag/8.0.18
- https://kjur.github.io/jsrsasign
- https://kjur.github.io/jsrsasign/api/symbols/ASN1HEX.html#.checkStrictDER
- https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.ECDSA.html
- https://security.netapp.com/advisory/ntap-20200724-0001
- https://vuldb.com/?id.157123
- https://www.npmjs.com/package/jsrsasign
CVE-2020-14966 · published · modified · JSON