{"action":"Upgrade jsrsasign to 8.0.19 or later.","affected":[{"fixed":"8.0.19","introduced":"4.0.0"}],"component":"jsrsasign","cve_ids":["CVE-2020-14966"],"ecosystem":"npm","epss":0.01125,"exploited":false,"fixed_versions":["8.0.19"],"ghsa_id":"GHSA-p8c3-7rj8-q963","id":"tcs_01M5KG31ETYBSAJPHYJME3X0MP","modified_at":"2023-11-08T04:02:28.073703Z","published_at":"2020-06-26T16:54:15Z","references":["https://osv.dev/vulnerability/GHSA-p8c3-7rj8-q963","https://github.com/kjur/jsrsasign/security/advisories/GHSA-p8c3-7rj8-q963","https://nvd.nist.gov/vuln/detail/CVE-2020-14966","https://github.com/kjur/jsrsasign/issues/437","https://github.com/kjur/jsrsasign/commit/6087412d072a57074d3c4c1b40bdde0460d53a7f","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14966","https://github.com/kjur/jsrsasign","https://github.com/kjur/jsrsasign/releases/tag/8.0.17","https://github.com/kjur/jsrsasign/releases/tag/8.0.18","https://kjur.github.io/jsrsasign","https://kjur.github.io/jsrsasign/api/symbols/ASN1HEX.html#.checkStrictDER","https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.ECDSA.html","https://security.netapp.com/advisory/ntap-20200724-0001","https://vuldb.com/?id.157123","https://www.npmjs.com/package/jsrsasign"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-p8c3-7rj8-q963","url":"https://osv.dev/vulnerability/GHSA-p8c3-7rj8-q963"}],"summary":"ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign"}