jsrsasign@8.0.20 vulnerabilities

opensource free pure JavaScript cryptographic library supports RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp and CAdES and JSON Web Signature(JWS)/Token(JWT)/Key(JWK)

  • latest version

    11.1.0

  • latest non vulnerable version

  • first published

    11 years ago

  • latest version published

    1 years ago

  • licenses detected

  • Direct Vulnerabilities

    Known vulnerabilities in the jsrsasign package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Observable Discrepancy

    jsrsasign is a free pure JavaScript cryptographic library.

    Affected versions of this package are vulnerable to Observable Discrepancy via the RSA PKCS#1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key.

    How to fix Observable Discrepancy?

    Upgrade jsrsasign to version 11.0.0 or higher.

    <11.0.0
    • H
    Improper Verification of Cryptographic Signature

    jsrsasign is a free pure JavaScript cryptographic library.

    Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake.

    How to fix Improper Verification of Cryptographic Signature?

    Upgrade jsrsasign to version 10.5.25 or higher.

    <10.5.25
    • M
    Cryptographic Weakness

    jsrsasign is a free pure JavaScript cryptographic library.

    Affected versions of this package are vulnerable to Cryptographic Weakness. Invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid.

    How to fix Cryptographic Weakness?

    Upgrade jsrsasign to version 10.1.13 or higher.

    <10.1.13