CVE-2024-21484

Katalog CVE

CVSS 5.9 · Medium EPSS 0,96%

Kerentanan Observable Discrepancy pada kjur jsrsasign. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.

Rincian

Terbit di NVD

22 Januari 2024

Terakhir diubah

22 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-203: Observable Discrepancy

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kjur/jsrsasign/issues/598 exploit · issue tracking · advisory vendor
• https://github.com/kjur/jsrsasign/releases/tag/11.0.0 patch · release notes
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6070734 patch · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-6070733 patch · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732 patch · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-6070731 patch · advisory pihak ketiga
• https://people.redhat.com/~hkario/marvin/