CVE-2020-14968
Critical · CVSS 9.8jsrsasign — RSASSA-PSS signature manipulation / memory corruption (CWE-119)
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-119
Description
An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending '\0' bytes to a signature (it accepts these modified signatures as valid). An attacker can abuse this behavior in an application by creating multiple valid signatures where only one signature should exist. Also, an attacker might prepend these bytes with the goal of triggering memory corruption issues.
Search profile — drives PoC discovery
Ranked PoCs (17) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0
- ★ 0KarthickSivalingam/jsrsasign-github needs reviewtrickest
- ★ 0Olaf0257/certificate-decode needs reviewtrickest
- ★ 0andrzejm57/certificate-decode needs reviewtrickest
- ★ 0andrzejm57/certificate-decode-javascript needs reviewtrickest
- ★ 0astreiten/jsrsasign-mod needs reviewtrickest
- ★ 0coachaac/jsrsasign-npm needs reviewtrickest
- ★ 0colaf57/certificate-decode-javascript needs reviewtrickest
- ★ 0devstar57/certificate-decode needs reviewtrickest
- ★ 0devstar57/certificate-decode-javascript needs reviewtrickest
- ★ 0diotoborg/laudantium-itaque-esse needs reviewtrickest
- ★ 0elite-devsolution/certificate-decode-javascript needs reviewtrickest
- ★ 0elitedev97/certificate-decode-javascript needs reviewtrickest
- ★ 0ericxuan57/certificate-decode-javascript needs reviewtrickest
- ★ 0f1stnpm2/nobis-minima-odio needs reviewtrickest
- ★ 0firanorg/et-non-error needs reviewtrickest
- ★ 0zibuthe7j11/repellat-sapiente-quas needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
Affected packages
| npm | jsrsasign | 3.0.0 → 8.0.17 |
References
- https://github.com/kjur/jsrsasign/issues/438
- https://github.com/kjur/jsrsasign/releases/tag/8.0.17
- https://github.com/kjur/jsrsasign/releases/tag/8.0.18
- https://kjur.github.io/jsrsasign/
- https://security.netapp.com/advisory/ntap-20200724-0001/
- https://www.npmjs.com/package/jsrsasign
- https://github.com/kjur/jsrsasign/issues/438
- https://github.com/kjur/jsrsasign/releases/tag/8.0.17
- https://github.com/kjur/jsrsasign/releases/tag/8.0.18
- https://kjur.github.io/jsrsasign/
- https://security.netapp.com/advisory/ntap-20200724-0001/
- https://www.npmjs.com/package/jsrsasign
Status: enriched · ingested 2026-06-22T06:00:15.000Z · profiled 2026-06-22T06:30:15.000Z