CVE-2020-14966

The jsrsasign library versions 7.0.0 up to 11.1.0 are vulnerable to incomplete comparison in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. An attacker can recover the private key by exploiting incorrect compareTo checks that accept out-of-range candidates, biasing DSA nonces during signature generation.

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. There is no known practical attack exploiting this vulnerability.

Versions of the jsrsasign package before 11.1.1 are vulnerable to division by zero, potentially leading to incorrect RSA public-key operations. An attacker can force these operations to return predetermined zero outputs, hiding 'invalid key' errors.

A vulnerability in the jsrsasign library before version 11.1.1 is due to incorrect conversion between numeric types when handling negative exponents in the ext/jsbn2.js file. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.

The jsrsasign library before version 11.1.1 is vulnerable to a missing cryptographic step in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, causing an invalid signature without retrying.

The jsrsasign library before version 11.1.1 is vulnerable to Improper Verification of Cryptographic Signature via DSA domain-parameter validation. An attacker can forge DSA signatures or X.509 certificates accepted by X509.verifySignature() by supplying malicious domain parameters (e.g., g=1, y=1, r=1).

A vulnerability in the jsrsasign library before version 11.1.1 causes an infinite loop in the bnModInverse function in ext/jsbn2.js. An attacker can permanently hang the process by passing zero or negative values to the BigInteger.modInverse method.

Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw.

The jsrsasign package before version 10.5.25 is vulnerable to improper verification of cryptographic signatures, which may lead to incorrect validation of JWS or JWT signatures containing invalid Base64URL encoding characters.