CVE-2020-14966

HighCVSS 7.5/10Last modified Jun 22, 2026

Description

An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/kjur/jsrsasign/issues/437Exploit, Issue Tracking, Third Party Advisory
https://github.com/kjur/jsrsasign/releases/tag/8.0.17Release Notes, Third Party Advisory
https://github.com/kjur/jsrsasign/releases/tag/8.0.18Release Notes, Third Party Advisory
https://kjur.github.io/jsrsasign/Release Notes, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200724-0001/Third Party Advisory
https://www.npmjs.com/package/jsrsasignProduct, Third Party Advisory
https://github.com/kjur/jsrsasign/issues/437Exploit, Issue Tracking, Third Party Advisory
https://github.com/kjur/jsrsasign/releases/tag/8.0.17Release Notes, Third Party Advisory
https://github.com/kjur/jsrsasign/releases/tag/8.0.18Release Notes, Third Party Advisory
https://kjur.github.io/jsrsasign/Release Notes, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200724-0001/Third Party Advisory
https://www.npmjs.com/package/jsrsasignProduct, Third Party Advisory

Timeline

Published: Jun 22, 2020
Last modified: Jun 22, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-149679.8An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect cip CVE-2020-149689.8An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signatur CVE-2020-149697.5app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch AP CVE-2020-14975.5An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploit CVE-2020-149717.8Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then resto CVE-2020-149729.8Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticated attackers to bypass CVE-2020-149736.1The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via CVE-2020-149747.1The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to unlock a file and kill processes (even ones running as SYSTEM) that hold CVE-2020-149757.8The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to delete, move, or copy arbitrary files via IOCTL code 0x222124.CVE-2020-149765.5GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary files because it handl CVE-2020-149778.1An issue was discovered in F-Secure SAFE 17.7 on macOS. The XPC services use the PID to identify the connecting client, which allows an atta CVE-2020-149788.1An issue was discovered in F-Secure SAFE 17.7 on macOS. Due to incorrect client version verification, an attacker can connect to a privilege