What is GHSA-h87q-g2wp-47pj?

GHSA-h87q-g2wp-47pj is a security advisory published by GitHub Security Advisories with Medium severity. Signatures are mistakenly recognized to be valid in jsrsasign

Why does GHSA-h87q-g2wp-47pj have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-h87q-g2wp-47pj?

GHSA-h87q-g2wp-47pj affects 1 product, including: npm/jsrsasign:\u003c 10.2.0.

GHSA-h87q-g2wp-47pjMediumDisclosed before NVD

Signatures are mistakenly recognized to be valid in jsrsasign

Vendor

GitHub Security Advisories

Published

February 9, 2022

Last Modified

January 9, 2023

📋 Description

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

🎯 Affected products1

npm/jsrsasign:< 10.2.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2021-30246
https://github.com/kjur/jsrsasign/issues/478
https://github.com/kjur/jsrsasign/releases/tag/10.1.13
https://kjur.github.io/jsrsasign/
https://github.com/kjur/jsrsasign/releases/tag/10.2.0
https://github.com/advisories/GHSA-h87q-g2wp-47pj