Vulnerability · Published Jan 22, 2024 · Assigned by snyk
CVE-2024-21484
High 7.5
In plain English
A high-severity security flaw in jsrsasign. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | jsrsasign | 11.0.0 | GHSA-rh63-9qcf-83gf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | jsrsasign | 0 – before 11.0.0 |
| n/a | org.webjars.npm:jsrsasign | 0 – before * |
| n/a | org.webjars.bowergithub.kjur:jsrsasign | 0 – before * |
| n/a | org.webjars.bower:jsrsasign | 0 – before * |
Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L/E:P
References
- https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-6070731
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-6070733
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6070734
- https://github.com/kjur/jsrsasign/issues/598
- https://github.com/kjur/jsrsasign/releases/tag/11.0.0
- https://people.redhat.com/~hkario/marvin/