{"action":"Upgrade jsrsasign to 8.0.17 or later.","affected":[{"fixed":"8.0.17","introduced":"3.0.0"}],"component":"jsrsasign","cve_ids":["CVE-2020-14968"],"ecosystem":"npm","epss":0.02863,"exploited":false,"fixed_versions":["8.0.17"],"ghsa_id":"GHSA-q3gh-5r98-j4h3","id":"tcs_01M5KG4YAH84R5CG0BBPCSHEZT","modified_at":"2023-11-08T04:02:28.196189Z","published_at":"2020-06-26T16:26:50Z","references":["https://osv.dev/vulnerability/GHSA-q3gh-5r98-j4h3","https://github.com/kjur/jsrsasign/security/advisories/GHSA-q3gh-5r98-j4h3","https://nvd.nist.gov/vuln/detail/CVE-2020-14968","https://github.com/kjur/jsrsasign/issues/438","https://github.com/kjur/jsrsasign/commit/3bcc088c727658d7235854cd2a409a904cc2ce99","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14968","https://github.com/kjur/jsrsasign","https://github.com/kjur/jsrsasign/releases/tag/8.0.17","https://github.com/kjur/jsrsasign/releases/tag/8.0.18","https://kjur.github.io/jsrsasign","https://kjur.github.io/jsrsasign/api/symbols/RSAKey.html#.verifyWithMessageHashPSS","https://security.netapp.com/advisory/ntap-20200724-0001","https://vuldb.com/?id.157125","https://www.npmjs.com/advisories/1541","https://www.npmjs.com/package/jsrsasign"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-q3gh-5r98-j4h3","url":"https://osv.dev/vulnerability/GHSA-q3gh-5r98-j4h3"}],"summary":"RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign"}