CVE-2020-14966
High
Description
An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.
SeverityHigh
CVSS7.5
Exploit probability—
ProductKjur Jsrsasign
PublishedJun 22, 2020
First seenJun 22, 2020
How to fix
Update
- jsrsasign8.0.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kjur jsrsasign | v ≤ 8.0.18 | — |
| netapp max_data | No range specified | — |
| jsrsasignnpm | 4.0.0 ≤ v < 8.0.19 | 8.0.19 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.