CVEvulnerability

CVE-2024-21484

5.9 MEDIUM Published 2024-01-22 Modified 2026-06-22 Official page ↗
Status
Modified
Published
2024-01-22
Last modified
2026-06-22
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-203

Description

Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.

Affected configurations

• kjur jsrsasign (< 11.0.0)

Related

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References