NVD disclosure day

Published threat advisories for June 22, 2020

CVE advisoryCRITICAL

CVE-2020-14968

jsrsasign RSASSA-PSS Signature Manipulation Vulnerability

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

A vulnerability exists in the jsrsasign Node.js package that allows an attacker to prepend null bytes to digital signatures, causing them to be accepted as valid. This manipulation could lead to unauthorized actions or system instability, and there is a possibility of memory corruption.

NVD published:

CVE advisoryCRITICAL

CVE-2020-14967

jsrsasign RSA PKCS1 v1.5 Decryption Allows Ciphertext Modification

Halo Surface Signal: 3 out of 5 — possibly public-facing.

A vulnerability exists in the jsrsasign Node.js package that allows an attacker to prepend null bytes to ciphertexts, bypassing detection and potentially causing memory corruption. This impacts systems using the affected library for cryptographic operations, and the reachability depends on how the library is implemente

NVD published: