jsrsasign vulnerabilities
opensource free pure JavaScript cryptographic library supports RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp and CAdES and JSON Web Signature(JWS)/Token(JWT)/Key(JWK)
- Registry
- npm
- Latest
- 11.1.5
- License
- MIT
14 known advisories
The latest version, 11.1.5, is not affected by any of them. Projects on older versions may be.
npm install jsrsasign@11.1.5Security advisories for jsrsasign
jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation
- Affected
- >=7.0.0 <11.1.1
- Fixed in
- 11.1.1
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations
- Affected
- <11.1.1
- Fixed in
- 11.1.1
Marvin Attack of RSA and RSAOAEP decryption in jsrsasign
- Affected
- <11.0.0
- Fixed in
- 11.0.0
JWS and JWT signature validation vulnerability with special characters
- Affected
- >=4.8.0 <10.5.25
- Fixed in
- 10.5.25
Signatures are mistakenly recognized to be valid in jsrsasign
- Affected
- <10.2.0
- Fixed in
- 10.2.0
RSA signature validation vulnerability on maleable encoded message in jsrsasign
- Affected
- <10.2.0
- Fixed in
- 10.2.0
ECDSA signature vulnerability of Minerva timing attack in jsrsasign
- Affected
- >=4.0.0 <8.0.13
- Fixed in
- 8.0.13
ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign
- Affected
- >=4.0.0 <8.0.19
- Fixed in
- 8.0.19
RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign
- Affected
- <8.0.18
- Fixed in
- 8.0.18
RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign
- Affected
- >=3.0.0 <8.0.17
- Fixed in
- 8.0.17
Which of your client projects still run an old jsrsasign?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.