REDHAT-BUG-2450209: High severity npm/jsrsasign vulnerability
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsrsasignto a version that resolves this vulnerability.Fixed in 11.1.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2450209?
The severity of REDHAT-BUG-2450209 is classified as high, with a CVSS score of 7.
What is the impact of REDHAT-BUG-2450209?
REDHAT-BUG-2450209 allows an attacker to recover the private key due to a missing cryptographic step in the DSA signing implementation.
How do I fix REDHAT-BUG-2450209?
To fix REDHAT-BUG-2450209, upgrade the jsrsasign package to version 11.1.1 or later.
Which versions are affected by REDHAT-BUG-2450209?
Versions of jsrsasign before 11.1.1 are affected by REDHAT-BUG-2450209.
What is the nature of the vulnerability in REDHAT-BUG-2450209?
REDHAT-BUG-2450209 is a Missing Cryptographic Step vulnerability in the DSA signing implementation.