REDHAT-BUG-2450210: High severity npm/jsrsasign vulnerability
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsrsasignto a version that resolves this vulnerability.Fixed in 11.1.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2450210?
The severity of REDHAT-BUG-2450210 is rated high with a score of 7.
How do I fix REDHAT-BUG-2450210?
To fix REDHAT-BUG-2450210, update the jsrsasign package to version 11.1.1 or later.
What attack vectors are associated with REDHAT-BUG-2450210?
REDHAT-BUG-2450210 allows an attacker to indefinitely hang the process by providing zero or negative inputs to the BigInteger.modInverse function.
Are all versions of jsrsasign affected by REDHAT-BUG-2450210?
Yes, all versions of the jsrsasign package prior to 11.1.1 are affected by REDHAT-BUG-2450210.
What is the impact of REDHAT-BUG-2450210 on applications using jsrsasign?
The impact of REDHAT-BUG-2450210 is that it can lead to denial of service by causing applications to become unresponsive.