https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 21:53:04 +0000 https://cve.radiocsirt.org/vuln/cnvd-2021-37764 cnvd-2021-37764 https://cve.radiocsirt.org/vuln/cnvd-2021-37764 https://cve.radiocsirt.org/vuln/euvd-2026-26678 EUVD-2026-26678 https://cve.radiocsirt.org/vuln/euvd-2026-26678 https://cve.radiocsirt.org/vuln/fkie_cve-2021-30246 <p>In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.</p> <p>In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-30246 https://cve.radiocsirt.org/vuln/ghsa-27fj-mc8w-j9wg <p><strong>Affected:</strong> npm: jsrsasign</p> <p>### Impact Vulnerable jsrsasign will accept RSA signature with improper PKCS#1.5 padding. Decoded RSA signature value consists following form: `01(ff...(8 or more ffs)...ff)00[ASN.1 OF DigestInfo]` Its byte length must be the same as RSA key length, however such checking was not sufficient.</p> <p>To make crafted message for practical attack is very hard.</p> <p>### Patches Users validating RSA signature should upgrade to 10.2.0 or later.</p> <p>### Workarounds There is no workaround. Not to use RSA signature validation in jsrsasign.</p> <p>### ACKNOWLEDGEMENT Thanks to Daniel Yahyazadeh @yahyazadeh for reporting and analyzing this vulnerability.</p> <p><strong>Affected:</strong> npm: jsrsasign</p> <p>### Impact Vulnerable jsrsasign will accept RSA signature with improper PKCS#1.5 padding. Decoded RSA signature value consists following form: `01(ff...(8 or more ffs)...ff)00[ASN.1 OF DigestInfo]` Its byte length must be the same as RSA key length, however such checking was not sufficient.</p> <p>To make crafted message for practical attack is very hard.</p> <p>### Patches Users validating RSA signature should upgrade to 10.2.0 or later.</p> <p>### Workarounds There is no workaround. Not to use RSA signature validation in jsrsasign.</p> <p>### ACKNOWLEDGEMENT Thanks to Daniel Yahyazadeh @yahyazadeh for reporting and analyzing this vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-27fj-mc8w-j9wg https://cve.radiocsirt.org/vuln/gsd-2021-30246 gsd-2021-30246 https://cve.radiocsirt.org/vuln/gsd-2021-30246