VDB
Sign up
HIGH7.5

GHSA-8g7p-jf3g-gxcp

jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

Quick fix

GHSA-8g7p-jf3g-gxcp — jsrsasign: upgrade to the fixed version with the command below.

npm install jsrsasign@11.1.1

Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/jsrsasign
Introduced in: 0Fixed in: 11.1.1
Fixnpm install jsrsasign@11.1.1

References