CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2020-14966
High (7.5). EPSS 1.1% chance of exploitation in the next 30 days. Fixed in jsrsasign 8.0.19.
An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
- CWE
- CWE-347
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kjur:jsrsasign
- netapp:max_data
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p8c3-7rj8-q963 | npm | jsrsasign | >=4.0.0 <8.0.19 | 8.0.19 |