PT-2023-8446 · Jsrsasign · Jsrsasign
Hubert Kario
·
Publicado
2023-11-21
·
Atualizado
2024-03-06
·
CVE-2024-21484
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
jsrsasign versions prior to 11.0.0
Description
The issue is related to an Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process in the jsrsasign package. An attacker can decrypt ciphertexts by exploiting this flaw, which is also known as the Marvin security flaw. Exploiting this issue requires the attacker to have access to a large number of ciphertexts encrypted with the same key. This vulnerability can be exploited to perform a Bleichenbacher or Marvin attack.
Recommendations
For jsrsasign versions prior to 11.0.0, update to jsrsasign 11.0.0 to resolve the issue.
As a temporary workaround, consider finding and replacing RSA and RSAOAEP decryption with another crypto library until the update is applied.
Exploit
Correção
Side Channel Attack
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Jsrsasign