Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-14967

An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.

Published

2020-06-22T12:15:10.150

Last Modified

2024-11-21T05:04:32.150

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-119

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	jsrsasign_project	jsrsasign	< 8.0.18	Yes
Application	netapp	max_data	-	Yes

References

https://github.com/kjur/jsrsasign/issues/439 Exploit, Issue Tracking, Third Party Advisory ([email protected])
https://github.com/kjur/jsrsasign/releases/tag/8.0.17 Release Notes, Third Party Advisory ([email protected])
https://github.com/kjur/jsrsasign/releases/tag/8.0.18 Release Notes, Third Party Advisory ([email protected])
https://kjur.github.io/jsrsasign/ Release Notes, Third Party Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20200724-0001/ Third Party Advisory ([email protected])
https://www.npmjs.com/package/jsrsasign Product, Third Party Advisory ([email protected])
https://github.com/kjur/jsrsasign/issues/439 Exploit, Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/kjur/jsrsasign/releases/tag/8.0.17 Release Notes, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/kjur/jsrsasign/releases/tag/8.0.18 Release Notes, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://kjur.github.io/jsrsasign/ Release Notes, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20200724-0001/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.npmjs.com/package/jsrsasign Product, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)