Marvin Attack of RSA and RSAOAEP decryption in jsrsasign
### Impact RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability. ### Patches update to jsrsasign 11.0.0. ### Workarounds Find and replace RSA and RSAOAEP decryption with other crypto library. ### References https://people.redhat.com/~hkario/marvin/ https://github.com/kjur/jsrsasign/issues/598 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21484
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-21484US | medium5.9 | — | ||
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by e… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/kjur/jsrsasignPACKAGE
- https://github.com/kjur/jsrsasign/issues/598WEB
- https://github.com/kjur/jsrsasign/releases/tag/11.0.0WEB
- https://github.com/kjur/jsrsasign/security/advisories/GHSA-rh63-9qcf-83gfWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-21484ADVISORY
- https://people.redhat.com/~hkario/marvinWEB
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6070734WEB
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-6070733WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan