In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NKjur Jsrsasign
APPKjur≤ 10.1.13
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Powiązane podatności
CVE-2026-4599CRITICAL9.3PL ✓ten sam produkt
Odtworzenie klucza prywatnego DSA przez błąd porównań w jsrsasign
CVE-2020-14968CRITICAL9.8ten sam produkt
An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implement...
CVE-2020-14967CRITICAL9.8ten sam produkt
An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption impl...
CVE-2026-4598HIGH7.7ten sam produkt
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function ...
CVE-2026-4600HIGH8.1ten sam produkt
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signa...