Signatures are mistakenly recognized to be valid in jsrsasign

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2021-30246 · ADVISORY
• kjur/jsrsasign · WEB
• kjur/jsrsasign release 10.1.13 · WEB
• kjur/jsrsasign release 10.2.0 · WEB
• kjur.github.io/jsrsasign · WEB

jsrsasign のその他の脆弱性

• CVE-2026-4603中 5.3Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.j…
• CVE-2026-4602高 7.5Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative expone…
• CVE-2026-4601緊急 9.1Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash pro…
• CVE-2026-4600緊急 9.1Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parame…
• CVE-2026-4599緊急 9.1Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRando…