Description (CNA)
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / jsrsasign | affected 0 before 11.1.1 |
| n/a / org.webjars.npm:jsrsasign | affected 0 before * |
CWE
CWE-347
References
- https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812268
- https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7
- https://github.com/kjur/jsrsasign/pull/646
- https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60
ADP enrichment
No English description supplied.
A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.
- https://access.redhat.com/security/cve/CVE-2026-4600
- https://bugzilla.redhat.com/show_bug.cgi?id=2450208
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4600.json
- https://access.redhat.com/errata/RHSA-2026:19409
- https://access.redhat.com/errata/RHSA-2026:19410
- https://access.redhat.com/errata/RHSA-2026:6912
- https://access.redhat.com/errata/RHSA-2026:6720
- https://access.redhat.com/errata/RHSA-2026:6568
- https://access.redhat.com/errata/RHSA-2026:19375
- https://access.redhat.com/errata/RHSA-2026:6926