Homepage
About Snyk

Memory Corruption Affecting jsrsasign package, versions <8.0.18

0.0
medium

Snyk CVSS

    Attack Complexity High

    Threat Intelligence

    EPSS 1.22% (86th percentile)
Expand this section
NVD
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-JSRSASIGN-572937
  • published 22 Jun 2020
  • disclosed 22 Jun 2020
  • credit Antonio de la Piedra
Report a new vulnerability Found a mistake?

Introduced: 22 Jun 2020

CVE-2020-14967 Open this link in a new tab
CWE-119 Open this link in a new tab

How to fix?

Upgrade jsrsasign to version 8.0.18 or higher.

Overview

jsrsasign is a free pure JavaScript cryptographic library.

Affected versions of this package are vulnerable to Memory Corruption. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.

References