Marvin Attack of RSA and RSAOAEP decryption in jsrsasign
### Impact RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability. ### Patches update to jsrsasign 11.0.0. ### Workarounds Find and replace RSA and RSAOAEP decryption with other crypto library. ### References https://people.redhat.com/~hkario/marvin/ https://github.com/kjur/jsrsasign/issues/598 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21484
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-21484US | medium5.9 | — | ||
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by e… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/kjur/jsrsasignPACKAGE
- https://github.com/kjur/jsrsasign/issues/598WEB
- https://github.com/kjur/jsrsasign/releases/tag/11.0.0WEB
- https://github.com/kjur/jsrsasign/security/advisories/GHSA-rh63-9qcf-83gfWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-21484ADVISORY
- https://people.redhat.com/~hkario/marvinWEB
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6070734WEB
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-6070733WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan