GHSA-h87q-g2wp-47pj

GHSA-h87q-g2wp-47pj · Signatures are mistakenly recognized to be valid in jsrsasign

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

Fix available

Published: 2022-02-09T22:41:19Z
Updated: 2022-02-15T01:51:57Z

Stack: node

Affected products and versions

jsrsasign npm
Affected ranges
- SEMVER: < 10.2.0
Update to 10.2.0

Original sources

https://nvd.nist.gov/vuln/detail/CVE-2021-30246
https://github.com/kjur/jsrsasign/issues/478
https://github.com/kjur/jsrsasign/releases/tag/10.1.13
https://github.com/kjur/jsrsasign/releases/tag/10.2.0
https://kjur.github.io/jsrsasign
https://osv.dev/vulnerability/GHSA-h87q-g2wp-47pj

Check your server →

GHSA-h87q-g2wp-47pj · Signatures are mistakenly recognized to be valid in jsrsasign

Affected products and versions

jsrsasign npm

Original sources