Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2020-14968: Release RSAPSS verification maleability fix and others · kjur/jsrsasign

An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending ‘\0’ bytes to a signature (it accepts these modified signatures as valid). An attacker can abuse this behavior in an application by creating multiple valid signatures where only one signature should exist. Also, an attacker might prepend these bytes with the goal of triggering memory corruption issues.

CVE
#vulnerability#nodejs#js#sap

JSRSASIGN SECURITY ADVISORY : 2020.06.22 CVE-2020-14968 RSA-PSS signature validation vulnerability by prepending zeros

  • Changes from 8.0.16 to 8.0.17
    • src/rsasign.js
      • verifyWithMessageHashPSS fixed for prepending zeros maleability (#438)
    • src/asn1x509.js
      • allow alternative algorithms to sign CRLs (#440)
    • src/asn1cms.js
      • improve CMSUtil.newSignedData helper with detached signatures (#441)
    • ext/rsa2.js
      • RSAGenerate fixed for not having requesting key length (#442)
    • sample_node
      • pemtobin was fixed for pemtohex function
    • test
      • qunit-do-rsagenkeylen.html new test code for (#442)
      • qunit-do-rsasign-pss.html add maleability test code (#438)
      • index.html, qunit-do-x509.html link update

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907