CVE-2024-21484
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw.
Risk Assessment
Exploiting this vulnerability may lead to the disclosure of sensitive data if an attacker gains access to a large number of ciphertexts encrypted with the same key.
Recommendation
It is recommended to find and replace RSA and RSAOAEP decryption with another crypto library to mitigate the risk.
Other vulnerabilities in jsrsasign
See all- CVE-2026-4599Critical
The jsrsasign library versions 7.0.0 up to 11.1.0 are vulnerable to incomplete comparison in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. An attacker can recover the private key by exploiting incorrect compareTo checks that accept out-of-range candidates, biasing DSA nonces during signature generation.
- CVE-2021-30246Critical
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. There is no known practical attack exploiting this vulnerability.
- CVE-2026-4603Medium
Versions of the jsrsasign package before 11.1.1 are vulnerable to division by zero, potentially leading to incorrect RSA public-key operations. An attacker can force these operations to return predetermined zero outputs, hiding 'invalid key' errors.
- CVE-2026-4602High
A vulnerability in the jsrsasign library before version 11.1.1 is due to incorrect conversion between numeric types when handling negative exponents in the ext/jsbn2.js file. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.
- CVE-2026-4601High
The jsrsasign library before version 11.1.1 is vulnerable to a missing cryptographic step in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, causing an invalid signature without retrying.
- CVE-2026-4600High
The jsrsasign library before version 11.1.1 is vulnerable to Improper Verification of Cryptographic Signature via DSA domain-parameter validation. An attacker can forge DSA signatures or X.509 certificates accepted by X509.verifySignature() by supplying malicious domain parameters (e.g., g=1, y=1, r=1).
- CVE-2026-4598High
A vulnerability in the jsrsasign library before version 11.1.1 causes an infinite loop in the bnModInverse function in ext/jsbn2.js. An attacker can permanently hang the process by passing zero or negative values to the BigInteger.modInverse method.
- CVE-2022-25898High
The jsrsasign package before version 10.5.25 is vulnerable to improper verification of cryptographic signatures, which may lead to incorrect validation of JWS or JWT signatures containing invalid Base64URL encoding characters.
- CVE-2020-14966High
An issue was discovered in the jsrsasign package through 8.0.18 for Node.js, allowing malleability in ECDSA signatures due to not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. Modified signatures are verified as valid.
Original NVD description (English source)
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.