CVE-2026-4601

Katalog CVE

CVSS 9.1 · Critical EPSS 0,47%

Kerentanan Missing Cryptographic Step pada kjur jsrsasign. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

Rincian

Terbit di NVD

23 Maret 2026

Terakhir diubah

10 September 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-325: Missing Cryptographic Step

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb patch
• https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586 exploit · mitigasi · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941 advisory pihak ketiga
• https://github.com/kjur/jsrsasign/pull/645 issue tracking
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812269
• https://access.redhat.com/errata/RHSA-2026:19375
• https://access.redhat.com/errata/RHSA-2026:19409
• https://access.redhat.com/errata/RHSA-2026:19410
• https://access.redhat.com/errata/RHSA-2026:6568
• https://access.redhat.com/errata/RHSA-2026:6720
• https://access.redhat.com/errata/RHSA-2026:6912
• https://access.redhat.com/errata/RHSA-2026:6926
• https://access.redhat.com/security/cve/CVE-2026-4601
• https://bugzilla.redhat.com/show_bug.cgi?id=2450209
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4601.json