Signatures are mistakenly recognized to be valid in jsrsasign

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-30246 · ADVISORY
• kjur/jsrsasign · WEB
• kjur/jsrsasign release 10.1.13 · WEB
• kjur/jsrsasign release 10.2.0 · WEB
• kjur.github.io/jsrsasign · WEB

More vulnerabilities in jsrsasign

• CVE-2026-4603MEDIUM 5.3Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.j…
• CVE-2026-4602HIGH 7.5Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative expone…
• CVE-2026-4601CRITICAL 9.1Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash pro…
• CVE-2026-4600CRITICAL 9.1Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parame…
• CVE-2026-4599CRITICAL 9.1Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRando…