GHSA-rh63-9qcf-83gf

Suggest an improvement
Source
https://github.com/advisories/GHSA-rh63-9qcf-83gf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-rh63-9qcf-83gf/GHSA-rh63-9qcf-83gf.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-rh63-9qcf-83gf
Aliases
Published
2024-01-19T15:06:07Z
Modified
2024-02-27T19:23:58Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L CVSS Calculator
Summary
Marvin Attack of RSA and RSAOAEP decryption in jsrsasign
Details

Impact

RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.

Patches

update to jsrsasign 11.0.0.

Workarounds

Find and replace RSA and RSAOAEP decryption with other crypto library.

References

https://people.redhat.com/~hkario/marvin/ https://github.com/kjur/jsrsasign/issues/598 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21484

Database specific 
{
    "cwe_ids": [
        "CWE-203"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-19T15:06:07Z",
    "nvd_published_at": "2024-01-22T05:15:08Z",
    "severity": "HIGH"
}
References

Affected packages

npm / jsrsasign

Package

Name
jsrsasign
View open source insights on deps.dev
Purl
pkg:npm/jsrsasign

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
11.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-rh63-9qcf-83gf/GHSA-rh63-9qcf-83gf.json"