Most recent entries from all

bdu:2024-00774

EUVD-2026-196483

fkie_cve-2024-21484

Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.

GHSA-rh63-9qcf-83gf — Marvin Attack of RSA and RSAOAEP decryption in jsrsasign

Affected: npm: jsrsasign

### Impact RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.

### Patches update to jsrsasign 11.0.0.

### Workarounds Find and replace RSA and RSAOAEP decryption with other crypto library.

### References https://people.redhat.com/~hkario/marvin/ https://github.com/kjur/jsrsasign/issues/598 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21484

gsd-2024-21484

RHBA-2024:0928 — Red Hat Bug Fix Advisory: MTV 2.5.5 Images

follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() jsrsasign: vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process