CVE-2020-14968
Critical
Description
An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending '\0' bytes to a signature (it accepts these modified signatures as valid). An attacker can abuse this behavior in an application by creating multiple valid signatures where only one signature should exist. Also, an attacker might prepend these bytes with the goal of triggering memory corruption issues.
SeverityCritical
CVSS9.8
Exploit probability—
ProductKjur Jsrsasign
PublishedJun 22, 2020
First seenJun 22, 2020
How to fix
Update
- kjur jsrsasign8.0.17 or later
- jsrsasign8.0.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kjur jsrsasign | v < 8.0.17 | 8.0.17 |
| netapp max_data | No range specified | — |
| jsrsasignnpm | 3.0.0 ≤ v < 8.0.17 | 8.0.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.