{"id":"CVE-2020-14966","published":"2020-06-22T11:20:13Z","modified":"2024-08-04T13:00:52Z","title":"An issue was discovered in the jsrsasign package through 8.0.18 for Node.js","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01125,"percentile":0.66289,"provenance":"source"},"cwes":[],"references":[{"url":"https://kjur.github.io/jsrsasign/","tags":["x_refsource_MISC"]},{"url":"https://www.npmjs.com/package/jsrsasign","tags":["x_refsource_MISC"]},{"url":"https://github.com/kjur/jsrsasign/issues/437","tags":["x_refsource_MISC"]},{"url":"https://github.com/kjur/jsrsasign/releases/tag/8.0.18","tags":["x_refsource_MISC"]},{"url":"https://github.com/kjur/jsrsasign/releases/tag/8.0.17","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20200724-0001/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":13.3,"factors":[{"name":"EPSS percentile","points":13.26}]},"affected":[{"ecosystem":"npm","package":"jsrsasign","vulnerableRanges":[">=4.0.0, <8.0.19"],"patched":["8.0.19"],"from":["GHSA-p8c3-7rj8-q963"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0505","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-14968","published":"2020-06-22","fixed":"8.0.17","kev":false},{"cve":"CVE-2020-14967","published":"2020-06-22","fixed":"8.0.18","kev":false,"link":{"from":"CVE-2020-14967","to":"CVE-2020-14966","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:jsrsasign","fromFixed":"8.0.18","toFixed":"8.0.19","daysApart":0}]}},{"cve":"CVE-2020-14966","published":"2020-06-22","fixed":"8.0.19","kev":false},{"cve":"CVE-2021-30246","published":"2021-04-07","fixed":"10.2.0","kev":false},{"cve":"CVE-2022-25898","published":"2022-07-01","fixed":"10.5.25","kev":false},{"cve":"CVE-2024-21484","published":"2024-01-22","fixed":"11.0.0","kev":false}],"package":"npm:jsrsasign"}}