Remote Code Execution (RCE) Affecting org.webjars.npm:jsrsasign package, versions [,10.4.1)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGWEBJARSNPM-574713
- published 22 Jun 2020
- disclosed 22 Jun 2020
- credit Antonio de la Piedra
Introduced: 22 Jun 2020
CVE-2020-14968 Open this link in a new tabHow to fix?
Upgrade org.webjars.npm:jsrsasign to version 10.4.1 or higher.
Overview
org.webjars.npm:jsrsasign is a free pure JavaScript cryptographic library.
Affected versions of this package are vulnerable to Remote Code Execution (RCE). Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending '\0' bytes to a signature (it accepts these modified signatures as valid). An attacker can abuse this behavior in an application by creating multiple valid signatures where only one signature should exist. Also, an attacker might prepend these bytes with the goal of triggering memory corruption issues.