Memory Corruption Affecting jsrsasign package, versions <8.0.18
Threat Intelligence
EPSS
1.63% (88th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-JSRSASIGN-572937
- published 22 Jun 2020
- disclosed 22 Jun 2020
- credit Antonio de la Piedra
Introduced: 22 Jun 2020
CVE-2020-14967 Open this link in a new tabHow to fix?
Upgrade jsrsasign to version 8.0.18 or higher.
Overview
jsrsasign is a free pure JavaScript cryptographic library.
Affected versions of this package are vulnerable to Memory Corruption. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.
References
CVSS Scores
version 3.1