Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Vulnerability Type
除零错误
Vulnerability Title
jsrsasign 安全漏洞
Vulnerability Description
jsrsasign是Kenji Urushima个人开发者的一个签名验证库。 jsrsasign 11.1.1之前版本存在安全漏洞，该漏洞源于ext/rsa.js和ext/jsbn.js中解析路径和归约逻辑存在除零错误，可能导致RSA公钥操作输出确定为零。
CVSS Information
N/A
Vulnerability Type
N/A