jsrsasign@9.1.2 vulnerabilities

opensource free pure JavaScript cryptographic library supports RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp and CAdES and JSON Web Signature(JWS)/Token(JWT)/Key(JWK)

Known vulnerabilities in the jsrsasign package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
H Observable Discrepancy jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Observable Discrepancy via the RSA PKCS#1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. How to fix Observable Discrepancy? Upgrade `jsrsasign` to version 11.0.0 or higher.	<11.0.0
H Improper Verification of Cryptographic Signature jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature when `JWS` or `JWT` signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. How to fix Improper Verification of Cryptographic Signature? Upgrade `jsrsasign` to version 10.5.25 or higher.	<10.5.25
M Cryptographic Weakness jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Cryptographic Weakness. Invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. How to fix Cryptographic Weakness? Upgrade `jsrsasign` to version 10.1.13 or higher.	<10.1.13