CVE-2022-25898: Improper Verification of Cryptographic Signature
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsrsasignto a version that resolves this vulnerability.Fixed in 10.5.25 - Configuration
Before calling JWS.verify() or JWS.verifyJWT(), validate that the JWS/JWT signature uses Base64URL encoding and is a dot-safe string (no special characters or number-escaped characters) and only then proceed with verification.
jsrsasign (JWS/JWT verification input) pre-verify signature encoding validation = Base64URL and dot-safe string
Event History
Frequently Asked Questions
What is CVE-2022-25898?
CVE-2022-25898 is a vulnerability in the package jsrsasign before version 10.5.25 which allows for improper verification of cryptographic signatures.
How severe is CVE-2022-25898?
CVE-2022-25898 is considered critical with a severity score of 9.8.
Which software versions are affected by CVE-2022-25898?
The vulnerability affects jsrsasign package versions between 4.8.0 and 10.5.24.
How can I fix CVE-2022-25898?
To fix CVE-2022-25898, upgrade to jsrsasign version 10.5.25 or later.
Are there any workarounds for CVE-2022-25898?
One workaround is to validate the JWS or JWT signature to ensure it has proper encoding.