CVE-2024-21484: High severity Jsrsasign Project Jsrsasign Node.js vulnerability
Impact RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.
Patches update to jsrsasign 11.0.0.
Workarounds Find and replace RSA and RSAOAEP decryption with other crypto library.
References https://people.redhat.com/~hkario/marvin/ https://github.com/kjur/jsrsasign/issues/598 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21484
Other sources
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/jsrsasignto a version that resolves this vulnerability.Fixed in 11.0.0 - Compensating control
Find and replace RSA and RSAOAEP decryption implemented with jsrsasign with equivalent functionality from a different, secure crypto library (i.e., replace RSA/RSAOAEP decryption calls using jsrsasign to mitigate the Marvin vulnerability).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21484?
CVE-2024-21484 is classified as a significant vulnerability due to its ability to allow RSA PKCS#1.5 or RSAOAEP ciphertexts to be decrypted through a specific attack.
How do I fix CVE-2024-21484?
To fix CVE-2024-21484, you should update to jsrsasign version 11.0.0.
What types of decryption are affected by CVE-2024-21484?
CVE-2024-21484 affects decryption using RSA PKCS#1.5 and RSAOAEP algorithms.
What are the recommended workarounds for CVE-2024-21484?
A recommended workaround for CVE-2024-21484 is to replace RSA and RSAOAEP decryption with an alternative cryptography library.
Which software package is impacted by CVE-2024-21484?
The software package impacted by CVE-2024-21484 is jsrsasign, specifically versions below 11.0.0.