Affected versions of this package are vulnerable to Timing Attack. Practical recovery of the long-term private key generated by the library is possible under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.
jsrsasign to version 8.0.13 or higher.
- Centre for Research on Cryptography and Security
- Snyk ID
- 03 Oct, 2019
- 31 Mar, 2020