CVE-2020-14968

npm/jsrsasign CVE-2020-14968: critical 9.8, EPSS 2.86%

RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign

Action: Upgrade jsrsasign to 8.0.17 or later.

npm i jsrsasign@8.0.17

Affected

Fixed versions

Sources

• osv: GHSA-q3gh-5r98-j4h3
• https://github.com/kjur/jsrsasign/security/advisories/GHSA-q3gh-5r98-j4h3
• https://nvd.nist.gov/vuln/detail/CVE-2020-14968
• https://github.com/kjur/jsrsasign/issues/438
• https://github.com/kjur/jsrsasign/commit/3bcc088c727658d7235854cd2a409a904cc2ce99
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14968
• https://github.com/kjur/jsrsasign
• https://github.com/kjur/jsrsasign/releases/tag/8.0.17
• https://github.com/kjur/jsrsasign/releases/tag/8.0.18
• https://kjur.github.io/jsrsasign
• https://kjur.github.io/jsrsasign/api/symbols/RSAKey.html#.verifyWithMessageHashPSS
• https://security.netapp.com/advisory/ntap-20200724-0001
• https://vuldb.com/?id.157125
• https://www.npmjs.com/advisories/1541
• https://www.npmjs.com/package/jsrsasign

CVE-2020-14968 · published 2020-06-26T16:26:50Z · modified 2023-11-08T04:02:28.196189Z · JSON