{"id":"CVE-2020-14966","published":"2020-06-22T11:20:13Z","modified":"2024-08-04T13:00:52Z","title":"An issue was discovered in the jsrsasign package through 8.0.18 for Node.js","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01125,"percentile":0.66202,"provenance":"source"},"cwes":[],"references":[{"url":"https://kjur.github.io/jsrsasign/","tags":["x_refsource_MISC"]},{"url":"https://www.npmjs.com/package/jsrsasign","tags":["x_refsource_MISC"]},{"url":"https://github.com/kjur/jsrsasign/issues/437","tags":["x_refsource_MISC"]},{"url":"https://github.com/kjur/jsrsasign/releases/tag/8.0.18","tags":["x_refsource_MISC"]},{"url":"https://github.com/kjur/jsrsasign/releases/tag/8.0.17","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20200724-0001/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":13.2,"factors":[{"name":"EPSS percentile","points":13.24}]},"affected":[{"ecosystem":"npm","package":"jsrsasign","vulnerableRanges":[">=4.0.0, <8.0.19"],"patched":["8.0.19"],"from":["GHSA-p8c3-7rj8-q963"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0505","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-jsrsasign-cve-2020-14966","children":[{"from":"CVE-2020-14966","to":"CVE-2020-14968","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["ext/rsa2.js"],"commits":["https://github.com/kjur/jsrsasign/commit/6087412d072a57074d3c4c1b40bdde0460d53a7f","https://github.com/kjur/jsrsasign/commit/3bcc088c727658d7235854cd2a409a904cc2ce99"],"basis":"rarely changed file"}]},{"from":"CVE-2020-14966","to":"CVE-2022-25898","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/files.html","bower.json","jsrsasign-all-min.js","jsrsasign-jwths-min.js","jsrsasign-rsa-min.js"],"commits":["https://github.com/kjur/jsrsasign/commit/6087412d072a57074d3c4c1b40bdde0460d53a7f","https://github.com/kjur/jsrsasign/commit/4536a6e9e8bcf1a644ab7c07ed96e453347dae41"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-14968","published":"2020-06-22","fixed":"8.0.17","kev":false},{"cve":"CVE-2020-14967","published":"2020-06-22","fixed":"8.0.18","kev":false,"link":{"from":"CVE-2020-14967","to":"CVE-2020-14966","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:jsrsasign","fromFixed":"8.0.18","toFixed":"8.0.19","daysApart":0}]}},{"cve":"CVE-2020-14966","published":"2020-06-22","fixed":"8.0.19","kev":false},{"cve":"CVE-2021-30246","published":"2021-04-07","fixed":"10.2.0","kev":false},{"cve":"CVE-2022-25898","published":"2022-07-01","fixed":"10.5.25","kev":false},{"cve":"CVE-2024-21484","published":"2024-01-22","fixed":"11.0.0","kev":false}],"package":"npm:jsrsasign"}}