REDHAT-BUG-2450207: High severity npm/jsrsasign vulnerability
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsrsasignto a version that resolves this vulnerability.Fixed in 11.1.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2450207?
The severity of REDHAT-BUG-2450207 is classified as high (7).
How do I fix REDHAT-BUG-2450207?
To fix REDHAT-BUG-2450207, update the jsrsasign package to version 11.1.1 or later.
What is the nature of the vulnerability in REDHAT-BUG-2450207?
REDHAT-BUG-2450207 involves an Incomplete Comparison with Missing Factors that can allow an attacker to recover the private key.
Which versions of jsrsasign are affected by REDHAT-BUG-2450207?
Versions of the jsrsasign package from 7.0.0 up to, but not including, 11.1.1 are affected by REDHAT-BUG-2450207.
What functions are related to the vulnerability in REDHAT-BUG-2450207?
The functions related to the vulnerability in REDHAT-BUG-2450207 are getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax.