GitHub Advisoryadvisory · npm

GHSA-h87q-g2wp-47pj Signatures are mistakenly recognized to be valid in jsrsasign

MEDIUM Published 2022-02-09 Modified 2022-02-15 Official page ↗
Ecosystem
npm
Packages
jsrsasign
Severity
Moderate
Weaknesses
CWE-347
Reviewed
2021-04-08

Affected packages

• npm jsrsasign: < 10.2.0 → fixed in 10.2.0

Description

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

Related

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References