CVE-2020-14966
CVE-2020-14966
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.
CVSS 7.5 · Alta · EPSS 1,1% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
Fuentes originales
- https://kjur.github.io/jsrsasign/
- https://www.npmjs.com/package/jsrsasign
- https://github.com/kjur/jsrsasign/issues/437
- https://github.com/kjur/jsrsasign/releases/tag/8.0.18
- https://github.com/kjur/jsrsasign/releases/tag/8.0.17
- https://security.netapp.com/advisory/ntap-20200724-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2020-14966