Is CVE-2020-14966 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-14966 being exploited in the wild.

How severe is CVE-2020-14966?

Low severity, with a CVSS score of 3.1, published 26 June 2020.

Which products and versions are affected?

jsrsasign (npm) SEMVER:introduced=4.0.0,fixed=8.0.19.

Is there a fix for CVE-2020-14966?

Yes. jsrsasign (npm): upgrade to 8.0.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-14966 attacked?

It is attacked over the network.

Am I affected by CVE-2020-14966?

Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-14966: jsrsasign ECDSA signature validation ASN.1 encoding bypass

CVE-2020-14966 · Severity: low · CVSS 3.1 · Published 2020-06-26

jsrsasign is a JavaScript cryptography library that validates ECDSA digital signatures, a security mechanism used to verify message authenticity. The library accepts malformed or non-standard ASN.1 encodings of ECDSA signatures that should be rejected, allowing an attacker to forge valid-looking signatures for messages they did not authorize. This could enable attackers to impersonate legitimate users or systems in applications relying on this library for signature validation.

Technologies: jsrsasign (npm). Vendors: npm.

Quick answers

Is CVE-2020-14966 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-14966 being exploited in the wild.
How severe is CVE-2020-14966?: Low severity, with a CVSS score of 3.1, published 26 June 2020.
Which products and versions are affected?: jsrsasign (npm) SEMVER:introduced=4.0.0,fixed=8.0.19.
Is there a fix for CVE-2020-14966?: Yes. jsrsasign (npm): upgrade to 8.0.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-14966 attacked?: It is attacked over the network.
Am I affected by CVE-2020-14966?: Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jsrsasign (npm): upgrade to 8.0.19 or later
```
npm install jsrsasign@8.0.19
```

Technical details

The vulnerability is a signature validation bypass caused by insufficient ASN.1 DER (Distinguished Encoding Rules) validation in ECDSA signature processing. The library accepts non-canonical ASN.1 encodings including: multi-byte length fields that are unnecessarily padded, leading zeros in INTEGER values, and trailing zeros appended to the signature structure. ECDSA signatures are network-reachable and no authentication is required for exploitation. An attacker can craft malformed but "semantically equivalent" signatures that will be accepted as valid, bypassing signature verification. The fix involves strict ASN.1 DER checking; users should upgrade to jsrsasign 8.0.19 or later. The risk is primarily an integrity issue (signature forgery) rather than memory corruption, as the library uses BigInteger classes that are not susceptible to overflow attacks.

Affected products

jsrsasign jsrsasign 4.0.0 to 8.0.18

Identifiers

CVE-2020-14966
GHSA-p8c3-7rj8-q963

Timeline

2020-06-22: disclosed
2020-06-23: advisory
2020-06-22: patched: Fixed in version 8.0.19

References

https://github.com/kjur/jsrsasign/security/advisories/GHSA-p8c3-7rj8-q963

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.