CVE-2020-14967: Buffer Overflow
An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-14967?
CVE-2020-14967 is a vulnerability in the jsrsasign package before version 8.0.18 for Node.js. It allows attackers to decrypt modified ciphertexts without error.
What is the severity of CVE-2020-14967?
CVE-2020-14967 has a severity rating of 9.8 (critical).
How does CVE-2020-14967 affect the jsrsasign package?
CVE-2020-14967 affects the jsrsasign package before version 8.0.18 for Node.js.
How can I fix CVE-2020-14967?
To fix CVE-2020-14967, update the jsrsasign package to version 8.0.18 or later.
What is CWE-119?
CWE-119 is a common weakness and exposure that refers to a flaw in the software's cryptographic security mechanism.