HighGHSA-rh63-9qcf-83gfCVE-2024-21484
Marvin Attack of RSA and RSAOAEP decryption in jsrsasign
Published 19 Jan 2024 · Updated 27 Feb 2024
Affected package
jsrsasignnpm
- Affected
- <11.0.0
- Fixed in
- 11.0.0
Update to the fixed version for your release line, for example:
npm install jsrsasign@11.0.0Details
Impact
RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.
Patches
update to jsrsasign 11.0.0.
Workarounds
Find and replace RSA and RSAOAEP decryption with other crypto library.
References
https://people.redhat.com/~hkario/marvin/ https://github.com/kjur/jsrsasign/issues/598 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21484
Is GHSA-rh63-9qcf-83gf in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected jsrsasign, and gives you the command that fixes it.
References
- Linkgithub.com/kjur/jsrsasign/security/advisories/GHSA-rh63-9qcf-83gf
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-21484
- Linkgithub.com/kjur/jsrsasign/issues/598
- Packagegithub.com/kjur/jsrsasign
- Linkgithub.com/kjur/jsrsasign/releases/tag/11.0.0
- Linkpeople.redhat.com/~hkario/marvin
- Linksecurity.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6070734
- Linksecurity.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-6070733
- Linksecurity.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732
- Linksecurity.snyk.io/vuln/SNYK-JS-JSRSASIGN-6070731
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.