PT-2020-14095 · Jsrsasign · Jsrsasign

Published 2020-06-22 · Updated 2023-01-27 · CVE-2020-14968

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 8.0.17

Description The issue concerns the RSASSA-PSS (RSA-PSS) implementation in the jsrsasign package, which fails to detect signature manipulation by prepending '0' bytes to a signature, accepting these modified signatures as valid. This behavior can be exploited by an attacker to create multiple valid signatures where only one should exist, or to trigger potential memory corruption issues by prepending these bytes.

Recommendations For versions prior to 8.0.17, update to version 8.0.17 or later to resolve the issue. As a temporary workaround, consider validating signatures to detect and prevent the prepending of '0' bytes.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2020-14968

GHSA-Q3GH-5R98-J4H3

Affected Products

Jsrsasign

References · 16

• 🔥 https://github.com/kjur/jsrsasign/issues/438 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-14968 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14968 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q3gh-5r98-j4h3 · Vendor Advisory
• https://github.com/kjur/jsrsasign · Note
• https://github.com/kjur/jsrsasign/releases/tag/8.0.17 · Note
• https://github.com/kjur/jsrsasign/releases/tag/8.0.18 · Note
• https://github.com/kjur/jsrsasign/commit/3bcc088c727658d7235854cd2a409a904cc2ce99 · Note
• https://github.com/kjur/jsrsasign/security/advisories/GHSA-q3gh-5r98-j4h3 · Note
• https://security.netapp.com/advisory/ntap-20200724-0001 · Note
• https://kjur.github.io/jsrsasign · Note
• https://npmjs.com/advisories/1541 · Note
• https://kjur.github.io/jsrsasign/api/symbols/RSAKey.html#.verifyWithMessageHashPSS · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14968 · Note
• https://vuldb.com/?id.157125 · Note