| Package | Affected versions | Patched versions |
|---|---|---|
| jsrsasign | < 11.0.0 | 11.0.0 |
| jsrsasign | < 11.0.0 | 11.0.0 |
RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.
update to jsrsasign 11.0.0.
Find and replace RSA and RSAOAEP decryption with other crypto library.
https://people.redhat.com/~hkario/marvin/ https://github.com/kjur/jsrsasign/issues/598 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21484
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free