Описание
An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.
Ссылки
- ExploitIssue TrackingThird Party Advisory
- Release NotesThird Party Advisory
- Release NotesThird Party Advisory
- Release NotesThird Party Advisory
- Third Party Advisory
- ProductThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
- Release NotesThird Party Advisory
- Release NotesThird Party Advisory
- Release NotesThird Party Advisory
- Third Party Advisory
- ProductThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 8.0.18 (исключая)
cpe:2.3:a:jsrsasign_project:jsrsasign:*:*:*:*:*:node.js:*:*
Конфигурация 2
cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:*
EPSS
Процентиль: 67%
0.00552
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-119
Связанные уязвимости
CVSS3: 9.8
github
почти 5 лет назад
RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign
EPSS
Процентиль: 67%
0.00552
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-119