PT-2020-14093 · Jsrsasign · Jsrsasign

Published 2020-06-22 · Updated 2023-01-28 · CVE-2020-14966

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions jsrsasign versions through 8.0.18

Description An issue in the jsrsasign package allows malleability in ECDSA signatures. This occurs because the package does not check for overflows in the length of a sequence and '0' characters appended or prepended to an integer, resulting in modified signatures being verified as valid. This could have security implications if an application relies on a single canonical signature.

Recommendations For versions through 8.0.18, update to a version that fixes this issue to prevent potential security risks.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2020-14966

GHSA-P8C3-7RJ8-Q963

Affected Products

Jsrsasign

References · 16

• 🔥 https://github.com/kjur/jsrsasign/issues/437 · Exploit
• https://osv.dev/vulnerability/GHSA-p8c3-7rj8-q963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14966 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14966 · Vendor Advisory
• https://github.com/kjur/jsrsasign · Note
• https://github.com/kjur/jsrsasign/releases/tag/8.0.17 · Note
• https://github.com/kjur/jsrsasign/releases/tag/8.0.18 · Note
• https://github.com/kjur/jsrsasign/commit/6087412d072a57074d3c4c1b40bdde0460d53a7f · Note
• https://github.com/kjur/jsrsasign/security/advisories/GHSA-p8c3-7rj8-q963 · Note
• https://kjur.github.io/jsrsasign/api/symbols/ASN1HEX.html#.checkStrictDER · Note
• https://security.netapp.com/advisory/ntap-20200724-0001 · Note
• https://kjur.github.io/jsrsasign · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14966 · Note
• https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.ECDSA.html · Note
• https://vuldb.com/?id.157123 · Note