Filtered by vendor Jsrsasign Project Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-21484 2 Jsrsasign Project, Redhat 2 Jsrsasign, Migration Toolkit Virtualization 2024-11-21 7.5 High
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.
CVE-2021-30246 1 Jsrsasign Project 1 Jsrsasign 2024-11-21 9.1 Critical
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.