Memory Corruption Affecting org.webjars.npm:jsrsasign package, versions [,10.4.1)
Threat Intelligence
EPSS
1.63% (88th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGWEBJARSNPM-574710
- published 22 Jun 2020
- disclosed 22 Jun 2020
- credit Antonio de la Piedra
Introduced: 22 Jun 2020
CVE-2020-14967 Open this link in a new tabHow to fix?
Upgrade org.webjars.npm:jsrsasign to version 10.4.1 or higher.
Overview
org.webjars.npm:jsrsasign is a free pure JavaScript cryptographic library.
Affected versions of this package are vulnerable to Memory Corruption. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.
References
CVSS Scores
version 3.1