REDHAT-BUG-2450206: High severity npm/jsrsasign vulnerability
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsrsasignto a version that resolves this vulnerability.Fixed in 11.1.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2450206?
The severity of REDHAT-BUG-2450206 is high, rated at 7.
How do I fix REDHAT-BUG-2450206?
To fix REDHAT-BUG-2450206, upgrade the jsrsasign package to version 11.1.1 or later.
What impact does REDHAT-BUG-2450206 have on security?
REDHAT-BUG-2450206 can lead to incorrect signature verification, allowing attackers to bypass security checks.
In which software is REDHAT-BUG-2450206 found?
REDHAT-BUG-2450206 is found in the npm package jsrsasign.
What triggers the vulnerability in REDHAT-BUG-2450206?
The vulnerability in REDHAT-BUG-2450206 is triggered by improper handling of negative exponents in the ext/jsbn2.js file.