CVE-2020-14966: High severity Jsrsasign Project Jsrsasign Node.js vulnerability
An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-14966?
CVE-2020-14966 is a vulnerability in the jsrsasign package for Node.js that allows for malleability in ECDSA signatures.
How does CVE-2020-14966 affect the jsrsasign package?
CVE-2020-14966 allows for malleability in ECDSA signatures by not properly checking overflows in the length of a sequence and '0' characters appended or prepended to an integer.
What is the severity of CVE-2020-14966?
CVE-2020-14966 has a severity rating of 7.5 (high).
Which software versions are affected by CVE-2020-14966?
The jsrsasign package versions through 8.0.18 for Node.js are affected by CVE-2020-14966.
How can I fix CVE-2020-14966?
To fix CVE-2020-14966, update the jsrsasign package to version 8.0.19 or later for Node.js.