REDHAT-BUG-2450208: High severity npm/jsrsasign vulnerability
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsrsasignto a version that resolves this vulnerability.Fixed in 11.1.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2450208?
The severity of REDHAT-BUG-2450208 is classified as high, with a score of 7.
How do I fix REDHAT-BUG-2450208?
To fix REDHAT-BUG-2450208, update jsrsasign to version 11.1.1 or later.
What kind of vulnerability is REDHAT-BUG-2450208?
REDHAT-BUG-2450208 involves improper verification of cryptographic signatures due to DSA domain-parameter validation issues.
Which software packages are affected by REDHAT-BUG-2450208?
The affected software package is jsrsasign, specifically versions before 11.1.1.
What can an attacker achieve with REDHAT-BUG-2450208?
An attacker can forge DSA signatures or X.509 certificates due to the vulnerability in REDHAT-BUG-2450208.