CVE-2024-21484
High
Description
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.
SeverityHigh
CVSS7.5
Exploit probability—
ProductKjur Jsrsasign
PublishedJan 22, 2024
First seenJan 22, 2024
Weakness typeCWE-203CWE-203
How to fix
Update
- kjur jsrsasign11.0.0 or later
- jsrsasign11.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kjur jsrsasign | v < 11.0.0 | 11.0.0 |
| jsrsasignnpm | v < 11.0.0 | 11.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.