Vulnerability Description
An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jsrsasign Project | Jsrsasign | <= 8.0.18 |
| Netapp | Max Data | - |
Related Weaknesses (CWE)
References
- https://github.com/kjur/jsrsasign/issues/437ExploitIssue TrackingThird Party Advisory
- https://github.com/kjur/jsrsasign/releases/tag/8.0.17Release NotesThird Party Advisory
- https://github.com/kjur/jsrsasign/releases/tag/8.0.18Release NotesThird Party Advisory
- https://kjur.github.io/jsrsasign/Release NotesThird Party Advisory
- https://security.netapp.com/advisory/ntap-20200724-0001/Third Party Advisory
- https://www.npmjs.com/package/jsrsasignProductThird Party Advisory
- https://github.com/kjur/jsrsasign/issues/437ExploitIssue TrackingThird Party Advisory
- https://github.com/kjur/jsrsasign/releases/tag/8.0.17Release NotesThird Party Advisory
- https://github.com/kjur/jsrsasign/releases/tag/8.0.18Release NotesThird Party Advisory
- https://kjur.github.io/jsrsasign/Release NotesThird Party Advisory
- https://security.netapp.com/advisory/ntap-20200724-0001/Third Party Advisory
- https://www.npmjs.com/package/jsrsasignProductThird Party Advisory
FAQ
What is CVE-2020-14966?
CVE-2020-14966 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appen...
How severe is CVE-2020-14966?
CVE-2020-14966 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-14966?
Check the references section above for vendor advisories and patch information. Affected products include: Jsrsasign Project Jsrsasign, Netapp Max Data.