CVE-2024-21484highCWE-203

CVE-2024-21484: high-severity vulnerability in jsrsasign

Published · Updated

Follow this CVE+ Monitor jsrsasign+ Monitor org.webjars.npm:jsrsasign

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.0%
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L/E:P
Affected products
n/a · jsrsasignn/a · org.webjars.bowergithub.kjur:jsrsasignn/a · org.webjars.bower:jsrsasignn/a · org.webjars.npm:jsrsasign