CVE-2022-25898
CVE-2022-25898 · Improper Verification of Cryptographic Signature
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.
CVSS 7.7 · Élevée · EPSS 1,2% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
Sources originales
- https://snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2935896
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-2935897
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2935898
- https://github.com/kjur/jsrsasign/commit/4536a6e9e8bcf1a644ab7c07ed96e453347dae41
- https://github.com/kjur/jsrsasign/releases/tag/10.5.25
- https://nvd.nist.gov/vuln/detail/CVE-2022-25898