Skip to content

Update dependency jsrsasign to v11 [SECURITY] - #426

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-jsrsasign-vulnerability
Open

Update dependency jsrsasign to v11 [SECURITY]#426
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-jsrsasign-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jan 19, 2024 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
jsrsasign (source) ^8.0.0 → ^11.0.0 age confidence

ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign

CVE-2020-14966 / GHSA-p8c3-7rj8-q963

More information

Details

Impact

Jsrsasign supports ECDSA signature validation which signature value is represented by ASN.1 DER encoding. This vulnerablity may accept a wrong ASN.1 DER encoded ECDSA signature such as:

  • wrong multi-byte ASN.1 length of TLV (ex. 0x820045 even though 0x45 is correct)
  • prepending zeros with ASN.1 INTEGER value (ex. 0x00000123 even though 0x0123 is correct)
  • appending zeros to signature of ASN.1 TLV (ex. 0x3082....1fbc000000 even though 0x3082....1fbc, appending zeros are ignored.)

This vulnerability was fixed by strict ASN.1 DER checking.

Here is an assessment of this vulnerability:

  • If you are not use ECDSA signature validation, this vulnerability is not affected.
  • Not ASN.1 format signature like just concatenation of R and S value is not affected such as Bitcoin.
  • This vulnerability is affected to all ECC curve parameters.
  • Risk to accept a forged or crafted message to be signed is low.
  • Risk to raise memory corruption is low since jsrsasign uses BigInteger class.
  • ECDSA signatures semantically the same to valid one may be accepted as valid. There are many malleable variants.

As discussed here, there is no standards like X9.62 which requires ASN.1 DER. So ASN.1 BER can be applied to ECDSA however most of implementations like OpenSSL do strict ASN.1 DER checking.

Patches

Users using ECDSA signature validation should upgrade to 8.0.19.

Workarounds

Do strict ASN.1 DER checking for ASN.1 encoded ECDSA signature value.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-14966
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14966
https://vuldb.com/?id.157123
https://github.com/kjur/jsrsasign/issues/437
https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.ECDSA.html
https://kjur.github.io/jsrsasign/api/symbols/ASN1HEX.html#.checkStrictDER
https://www.itu.int/rec/T-REC-X.690

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

ECDSA signature vulnerability of Minerva timing attack in jsrsasign

GHSA-g753-jx37-7xwh

More information

Details

Impact

ECDSA side-channel attack named Minerava have been found and it was found that it affects to jsrsasign.

Execution time of thousands signature generation have been observed then EC private key which is scalar value may be recovered since point and scalar multiplication time depends on bits of scalar. In jsrsasign 8.0.13 or later, execution time of EC point and scalar multiplication is almost constant and fixed for the issue.

  • Minerva is one of timing attack or side channel attack for EC.
  • If you don't use ECDSA class, you are not affected the vulnerability.
  • The vulnerability is that attacker may guess private key by checking processing time of EC key generation or ECDSA signing.
  • The cause issue is that point multiplication processing time in ECDSA signing is depends on private key value.
  • After 8.0.13, processing time of point multiplication in ECDSA signing have become constant for key value in theory.
Patches

Users using ECDSA signature generation should upgrade to 8.0.13 or later.

Workarounds

There is no workarounds in jsrsasign. Update jsrsasign or use other ECDSA library.

ACKNOWLEDGEMENT

Thanks to Jan Jancar @​J08nY, Petr Svenda and Vladimir Sedlacek of Masaryk University in Czech Republic to find and report this vulnerability.

References

https://minerva.crocs.fi.muni.cz/
https://www.npmjs.com/advisories/1505
https://github.com/kjur/jsrsasign/issues/411

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign

CVE-2020-14968 / GHSA-q3gh-5r98-j4h3

More information

Details

Impact

Jsrsasign can verify RSA-PSS signature which value can expressed as BigInteger. When there is a valid RSA-PSS signature value, this vulnerability is also accept value with prepending zeros as a valid signature.

  • If you are not use RSA-PSS signature validation, this vulnerability is not affected.
  • Risk to accept a forged or crafted message to be signed is low.
  • Risk to raise memory corruption is low since jsrsasign uses BigInteger class.
Patches

Users using RSA-PSS signature validation should upgrade to 8.0.17.

Workarounds

Reject RSA-PSS signatures with unnecessary prepending zeros.

References

GHSA-q3gh-5r98-j4h3
https://github.com/kjur/jsrsasign/issues/438
https://nvd.nist.gov/vuln/detail/CVE-2020-14968
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14968
https://vuldb.com/?id.157125
https://kjur.github.io/jsrsasign/api/symbols/RSAKey.html#.verifyWithMessageHashPSS

Severity

  • CVSS Score: 9.8 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign

CVE-2020-14967 / GHSA-xxxq-chmp-67g4

More information

Details

Impact

Jsrsasign supports RSA PKCS#1 v1.5 (i.e. RSAES-PKCS1-v1_5) and RSA-OAEP encryption and decryption. Its encrypted message is represented as BigInteger. When there is a valid encrypted message, a crafted message with prepending zeros can be decrypted by this vulnerability.

  • If you don't use RSA PKCS1-v1_5 or RSA-OAEP decryption, this vulnerability is not affected.
  • Risk to forge contents of encrypted message is very low.
  • Risk to raise memory corruption is low since jsrsasign uses BigInteger class.
Patches

Users using RSA PKCS1-v1_5 or RSA-OAEP decryption should upgrade to 8.0.18.

Workarounds

Reject RSA PKCS1-v1_5 or RSA-OAEP encrypted message with unnecessary prepending zeros.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-14967
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14967
https://vuldb.com/?id.157124
https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.Cipher.html#.decrypt
https://github.com/kjur/jsrsasign/issues/439

Severity

  • CVSS Score: 9.8 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

RSA signature validation vulnerability on maleable encoded message in jsrsasign

CVE-2021-30246 / GHSA-27fj-mc8w-j9wg

More information

Details

Impact

Vulnerable jsrsasign will accept RSA signature with improper PKCS#1.5 padding.
Decoded RSA signature value consists following form:
01(ff...(8 or more ffs)...ff)00[ASN.1 OF DigestInfo]
Its byte length must be the same as RSA key length, however such checking was not sufficient.

To make crafted message for practical attack is very hard.

Patches

Users validating RSA signature should upgrade to 10.2.0 or later.

Workarounds

There is no workaround. Not to use RSA signature validation in jsrsasign.

ACKNOWLEDGEMENT

Thanks to Daniel Yahyazadeh @​yahyazadeh for reporting and analyzing this vulnerability.

Severity

  • CVSS Score: 9.1 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Signatures are mistakenly recognized to be valid in jsrsasign

GHSA-h87q-g2wp-47pj

More information

Details

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

Severity

Medium

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

JWS and JWT signature validation vulnerability with special characters

CVE-2022-25898 / GHSA-3fvg-4v2m-98jf

More information

Details

Impact

Jsrsasign supports JWS(JSON Web Signatures) and JWT(JSON Web Token) validation. However JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake.

For example, even if a string of non Base64URL encoding characters such as !@$% or \11 is inserted into a valid JWS or JWT signature value string, it will still be a valid JWS or JWT signature by mistake.

When jsrsasign's JWS or JWT validation is used in OpenID connect or OAuth2, this vulnerability will affect to authentication or authorization.

By our internal assessment, CVSS 3.1 score will be 8.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Patches

Users validate JWS or JWT signatures should upgrade to 10.5.25.

Workarounds

Validate JWS or JWT signature if it has Base64URL and dot safe string before
executing JWS.verify() or JWS.verifyJWT() method.

ACKNOWLEDGEMENT

Thanks to Adi Malyanker and Or David for this vulnerability report. Also thanks for Snyk security team for this coordination.

References

https://github.com/kjur/jsrsasign/releases/tag/10.5.25
GHSA-3fvg-4v2m-98jf kjur's advisories
GHSA-3fvg-4v2m-98jf github advisories
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25898
https://kjur.github.io/jsrsasign/api/symbols/KJUR.jws.JWS.html#.verifyJWT
https://kjur.github.io/jsrsasign/api/symbols/KJUR.jws.JWS.html#.verify
https://kjur.github.io/jsrsasign/api/symbols/global__.html#.isBase64URLDot
https://github.com/kjur/jsrsasign/wiki/Tutorial-for-JWS-verification
https://github.com/kjur/jsrsasign/wiki/Tutorial-for-JWT-verification
https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122

Severity

  • CVSS Score: 8.6 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Marvin Attack of RSA and RSAOAEP decryption in jsrsasign

CVE-2024-21484 / GHSA-rh63-9qcf-83gf

More information

Details

Impact

RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.

Patches

update to jsrsasign 11.0.0.

Workarounds

Find and replace RSA and RSAOAEP decryption with other crypto library.

References

https://people.redhat.com/~hkario/marvin/
https://github.com/kjur/jsrsasign/issues/598
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21484

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

CVE-2026-4598 / GHSA-8g7p-jf3g-gxcp

More information

Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Severity

  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction

CVE-2026-4601 / GHSA-w8q8-93cx-6h7r

More information

Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

Severity

  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation

CVE-2026-4599 / GHSA-5jx8-q4cp-rhh6

More information

Details

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass

CVE-2026-4602 / GHSA-8qwj-4jxw-m8jw

More information

Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.

Severity

  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic

CVE-2026-4600 / GHSA-wvqx-v3f6-w8rh

More information

Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations

CVE-2026-4603 / GHSA-464q-cqxq-xhgr

More information

Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.

Severity

  • CVSS Score: 2.0 / 10 (Low)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

kjur/jsrsasign (jsrsasign)

v11.1.1

Compare Source

v11.1.0: restore KJUR.crypto.Cipher class without RSA/RSAOAEP support

Compare Source

  • Changes from 11.0.0 to 11.1.0 (2024-Feb-01)
    • src/crypto.js
      • restore KJUR.crypto.Cipher class without RSA and RSAOAEP encryption/decryption support

v11.0.0: remove RSA and RSAOAEP encryption for Marvin attack

Compare Source

  • Changes from 10.9.0 to 11.0.0 (2024-Jan-16)
    • remove RSA PKCS#1.5 end OAEP encryption/decryption for Marvin attack (#​598)
    • src/crypto.js
      • remove KJUR.crypto.Cipher class for RSA and RSAOAEP encryption/decryption
    • ext/{rsa,rsa2}.js
      remove encrypt/decrypt/encryptOAEP/decryptOAEP for RSAKey class

v10.9.0: enhanced support for encrypted PKCS8

Compare Source

  • Changes from 10.8.6 to 10.9.0 (2023-Nov-27)
    • KEYUTIL.getPEM is updated not to use weak ciphers (#​599)
      • default encryptionScheme is changed from des-EDE3-CBC to aes256-CBC
      • default prf is changed from hmacWithSHA1 to hmacWithSHA256
    • src/keyutil.js
      • more encrypted PKCS#8 private key support
        • KEYUTIL.getKey now supports encrypted PKCS#8 private key with
          aes128-CBC, aes256-CBC encrypted and using hmacWithSHA224/256/384/512 as
          psudorandom function.
        • KEYUTIL.getPEM now supports such as above encrypted PKCS#8 PEM
          priavte key.
    • src/crypto.js
      • Cipher.decrypt/encrypt now supports symmetric ciphers (des-EDE3-CBC,aes128-CBC,aes256-CBC)
    • src/base64x.js
      • function inttohex and twoscompl are added
    • src/asn1.js
      • ASN1Util.bigIntToMinTwosComplementsHex is now DEPRECATED. use twoscompl.
    • src/asn1x509.js
      • aes*-CBC and hmacWithSHA* OIDs are added
    • test/qunit-do-{base64x,crypto-cipher,keyutil-eprv,keyutil,keyutil-p8egen}.html
      • update and add some test cases for above
    • stop bower support (bower.json removed)

v10.8.6: X509.getExtSubjectDirectoryAttributes another bugfix

Compare Source

  • Changes from 10.8.5 to 10.8.6 (2023-Apr-26)
    • src/x509.js
      • another bugfix X509.getExtSubjectDirectoryAttributes method

v10.8.5: X509.getExtSubjectDirectoryAttributes bugfix

Compare Source

  • Changes from 10.8.4 to 10.8.5 (2023-Apr-26)
    • src/x509.js
      • bugfix X509.getExtSubjectDirectoryAttributes method

v10.8.4: more SubjectDirectoryExtension support

Compare Source

  • Changes from 10.8.3 to 10.8.4 (2023-Apr-26)
    • src/asn1x509.js
      • SubjectDirectoryAttributes class
        • add array of array support for arbitrary attribute value
    • src/x509.js
      • add X509.getExtSubjectDirectoryAttributes method for
        ExtSubjectDirectoryAttributes extension
      • update X509.getExtParam method
        • support SubjectDirectoryAttributes
        • parse unknown extension as ASN.1
    • src/base64x.js
      • bugfix foldnl function: when length of s is multiple of n,
        result has unnecessary new line in the end of string.
    • qunit-do-{asn1x509,x509-ext,base64x,x500-param}.html
      • update and add some test cases for above

v10.8.3: CABF SMIMEBR OID support

Compare Source

  • Changes from 10.8.2 to 10.8.3 (2023-Apr-20)
    • src/asn1x509.js
      • Add OIDs for CABR S/MIME BR policy OIDs and GN givenName attribute type

v10.8.2: RSA OAEP encryption fix

Compare Source

  • Changes from 10.8.1 to 10.8.2 (2023-Apr-15)
    • ext/rsa.js
      • fix RSAEncryptOAEP for RSA OAEP encryption #​582 #​583
        In rare cases, it have been generated ciphertext that
        could not be decrpyted.

v10.8.1: npm export missing fix

Compare Source

  • Changes from 10.8.0 to 10.8.1 (2023-Apr-09)
    • npm/{package.json, lib/footer.js}

v10.8.0: UserNotice of CertificatePolicies support and more

Compare Source

  • Changes from 10.7.0 to 10.8.0 (2023-Apr-8)
    • x509.js
      • X509.getUserNotice supports NoticeReference
      • add asn1ToDisplayText method
    • base64x.js
      • add function msectozulu
      • add aryval for nested JSON value access
    • asn1.js
      • DERInteger refactoring
    • test/qunit-do-{asn1,asn1x509,base64x,x509-ext}.html
      • update and add some test cases for above

v10.7.0: custom X.509 extension support and utility functions

Compare Source

  • Changes from 10.6.1 to 10.7.0 (2023-Mar-12)
    • x509.js
      • add X509.registExtParser(): register custom extension parser
    • base64x.js
      • add utility functions
        • b64topem() Base64 string to PEM
        • pemtob64() PEM to Base64 string
        • foldnl() wrap string to fit in specified width
        • timetogen() align to UTCTime to GeneralizedTime
    • test/qunit-do-{x509-ext,base64x}.html
      • update and add some test cases for above

v10.6.1: Add PolicyMappings, PolicyConstraints and InhibitAnyPolicy extension support

Compare Source

  • Changes from 10.6.0 to 10.6.1 (2022-Nov-20)
    • asn1x509.js
      • KJUR.asn1.x509.{PolicyMappings,PolicyConstraints,InhibitAnyPolicy} class added
      • KJUR.asn1.x509.Extension updated to support
        PolicyMappings, PolicyConstraints and InhibitAnyPolicy
    • x509.js
      • X509.getExt{PolicyMappings,PolicyConstraints,InhibitAnyPolicy} method added
      • X509.getCriticalExtV utility method added
      • X509.getExtParam updated to support
        {PolicyMappings,PolicyConstraints,InhibitAnyPolicy}
      • X509.getInfo updated to support
        {PolicyMappings,PolicyConstraints,InhibitAnyPolicy}
    • test/qunit-do-{asn1x509-tbscert,x509-ext,x509-getinfo,x509-param}.html
      • update and add some test cases for above

v10.6.0: StringPrep DN canonicalization support and some fix

Compare Source

z* Changes from 10.5.27 to 10.6.0 (2022-Nov-04)

  • x509.js
    • X509.getParam
      • add support for optional parameter "dncanon" and "dnhex"
    • X509.getInfo
      • update representation for AltName
    • X509.{getIssuer,getSubect}
      • add support for optional argument flagCanon, flagHex
    • X509.c14RDNArray added to convert from RDN array to canonicalized
      DN name (a.k.a. StringPrep).
    • X509.getX500Name
      • API document updated
    • X509.getOtherName
      • member name changed from "other" to "value" for
        consistency with KJUR.asn1.x509.OtherName class constructor.
      • Also oid member value in return object will be an oid name if defined.
    • X509.setCanonicalizedDN added to set "canon" member value
  • asn1x509.js
    • smtpUTF8Mailbox oid added to OID class
    • API document fix
  • asn1.js
    • DERTaggedObject API document update
  • test/qunit-do-{asn1x509,x509-ext,x509-getinfo,x509-param,x509}.html
    • update some test cases for above

v10.5.27: extend CertificationRequestInfo class for challengePassword and unstructuredName

Compare Source

  • Changes from 10.5.26 to 10.5.27 (2022-Aug-19)
    • src/asn1csr.js
      • CertificationRequestInfo class
        • add support for challengePassword and unstructuredName (#​522)
        • "attrs" member support in constructure argument
    • test/qunit-do-asn1csr.html

v10.5.26: CSRUtil class enhancement

Compare Source

  • Changes from 10.5.25 to 10.5.26 (2022-Jul-14)
    • src/asn1csr.js
      • CSRUtil.verifySignature method added
      • CSRUtil.getParam enhanced to support optional argument flagTBS
    • test/qunit-do-asn1csr.html
      • update some test cases for above

v10.5.25: CVE-2022-25898 Security fix in JWS and JWT validation

Compare Source

  • Changes from 10.5.24 to 10.5.25 (2022-Jun-23)
    • src/jws.js
      • JWS.verify and JWS.verifyJWT
        • CVE-2022-25898 SECURITY FIX:
          verify and verifyJWT may accept signature with special characters
          or \number characters by mistake.
          Please see security advisory:
          GHSA-3fvg-4v2m-98jf
    • src/base64x.js
      • function isBase64URLDot added
    • test/qunit-do-jwt-veri.html

v10.5.24: X509.getParam bugfix for v1 certificate

Compare Source

  • Changes from 10.5.23 to 10.5.24 (2022-Jun-04)
    • src/x509.js
      • X509.getParam bugfix for X.509v1 certificate without extension

v10.5.23: BitString parsing bug fix

Compare Source

  • Changes from 10.5.22 to 10.5.23 (2022-May-27)
    • src/base64x.js
      • bitstrtobinstr bugfix fix
    • src/asn1hex.js
      • ASN1HEX.parse change for bin string range
    • npm/lib/footers.js
      • add missed exports (bitstrtobinstr, binstrtobitstr,
        namearraytobinstr, extendClass)
    • test/qunit-do-{asn1hex-parse,base64x}.html
      • add and fix some test cases for above

v10.5.22: DERBitString, KeyUsage and tsp PKIFailureInfo critical bug fix

Compare Source

  • Changes from 10.5.21 to 10.5.22 (2022-May-24)
    • src/asn1.js
      • DERBitString critical bugfix
    • src/asn1tsp.js
      • PKIFailureInfo critical bugfix
    • src/asn1x509.js
      • KeyUsage critical bugfix
    • src/base64.x
      • namearraytobinstr critical bugfix
    • test/qunit-do-{asn1,asn1tsp,asn1x509,base64x}.html
      • add and fix some test cases for above

v10.5.21

Compare Source

v10.5.20: OCSP ResponderID object udpate

Compare Source

  • Changes from 10.5.19 to 10.5.20 (2022-Apr-25)
    • src/asn1ocsp.js
      • ResponderID class now also supports PEM certificate or
        X509 object for key and name field.
    • test/qunit-do-asn1ocsp.html
      • add some test cases and fix for above
    • remove silver sponsor

v10.5.19: Time stamp package update

Compare Source

  • Changes from 10.5.18 to 10.5.19 (2022-Apr-23)
    • src/asn1tsp.js
      • TimeStampResp class update to statusinfo member
        will be optional. If omitted, it will be "granted" by default.
      • API manual update for more detail

v10.5.18: Time stamp package update

Compare Source

  • Changes from 10.5.17 to 10.5.18 (2022-Apr-22)
    • src/asn1tsp.js
      • TSPParser.getTimeStampReq added
      • TSPUtil.parse{TimeStampReq,MessageImprint} now DEPRECATED. Please use TSPParser.
    • test/qunit-do-asn1tsp.html
      • add some test cases and fix for above

v10.5.17: CIDR subnet mask support in iptohex and hextoip

Compare Source

  • Changes from 10.5.16 to 10.5.17 (2022-Apr-14)
    • src/asn1x509.js
      • add IP address support in NameConstraints class
      • bugfix in NameConstraints ip address
      • wrong ASN.1 encoder in NameConstraints class bug fix (wrong explicit tag)
    • src/base64x.js
      • add CIDR subnet mask support in iptohex and hextoip
      • iptohex, hextoip refactoring
    • test/qunit-do-{x509-ext,base64x,asn1x509-tbscert,asn1x509}.html
      • add some test cases and fix for above

v10.5.16: Add NameConstraints extension and modify getEncodedHex to tohex

Compare Source

  • Changes from 10.5.15 to 10.5.16 (2022-Apr-08)
    • src/asn1x509.js
      • NameConstraints and GeneralSubtree class added
      • add support for nameConstraints in Extensions class
      • remove old GeneralName code
    • src/x509.js
      • getExtNameConstraints and getGeneralSubbtree method added
      • add support for nameConstraints in getParam method
      • X509.getParam supports optional arguments:
        • tbshex: to return hexadecimal tbsCertificate value
        • nodnarray: delete array member of subject and issuer
          in the result.
    • src/x509crl.js
      • X509CRL.getParam supports optional arguments:
        • tbshex: to return hexadecimal tbsCertList value
        • nodnarray: delete array member of subject and issuer
          in the result.
    • src/asn1.js
      • ASN1Object.tohex() method added
      • ASN1Object.getEncodedHex() method is now DEPRECATED.
        Please use ASN1Object.tohex() instead.
      • clean up some codes
    • src/*.js
      • update for ASN1Object.tohex()
    • test/qunit-do-x509-ext.html
      • getExtNameConstraints and getGeneralSubtree method test added
    • test/qunit-do-asn1x509.html
      • NameConstraints and GeneralSubtree class test added
    • test/qunit-do-asn1-newobj.html
      • int and tag test refactoring
      • bugfix

v10.5.15: X509.getExtCRLDistributionPointsURI small fix

Compare Source

  • Changes from 10.5.14 to 10.5.15 (2022-Apr-06)
    • src/x509.js
      • fix X509.getExtCRLDistributionPointsURI. This returns
        undefined when no CDP extension as specified in document
        even though it is deprecated method.

v10.5.14: KEYUTIL.getPEM small fix

Compare Source

  • Changes from 10.5.13 to 10.5.14 (2022-Mar-28)
    • src/keyutil.js
      • fix KEYUTIL.getPEM when public key is not specified for ECDSA object.
        optional public key field will be omitted in such case. (#​549)
    • test/qunit-do-*.html
      • test case added for above updates.

v10.5.13: RSA key private generation fix

Compare Source

  • Changes from 10.5.12 to 10.5.13 (2022-Mar-18)
    • ext/rsa2.js
      • fix RSAGenerate for checking |p - q| (#​546)

v10.5.12: support ISO 8859-1 TeletexString and BMPString for X500Name

Compare Source

  • Changes from 10.5.11 to 10.5.12 (2022-Mar-13)
    • src/asn1hex.js
      • ASN1HEX.parse fixed for TeletexString and BMPString
      • ASN1HEX.parse TeletexString supports non-ASCII
        ISO 8859-1 Latin1 characters. Before this version,
        only supports ASCII characters.
      • hextoipv6 bug fix raised in some of enviroment
    • src/base64x.js
      • iso88591hextou

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Jan 19, 2024

Copy link
Copy Markdown
Author

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: amp-update-cache/package-lock.json

@renovate
renovate Bot force-pushed the renovate/npm-jsrsasign-vulnerability branch from 664e36c to 1d3c6de Compare August 8, 2024 20:57
@renovate renovate Bot changed the title Update dependency jsrsasign to v11 [SECURITY] Update dependency jsrsasign to v10 [SECURITY] Aug 8, 2024
@renovate
renovate Bot force-pushed the renovate/npm-jsrsasign-vulnerability branch from 1d3c6de to 83a229f Compare August 15, 2025 20:15
@renovate renovate Bot changed the title Update dependency jsrsasign to v10 [SECURITY] Update dependency jsrsasign to v11 [SECURITY] Aug 15, 2025
@renovate
renovate Bot force-pushed the renovate/npm-jsrsasign-vulnerability branch from 83a229f to 99a9aea Compare October 16, 2025 07:14
@renovate renovate Bot changed the title Update dependency jsrsasign to v11 [SECURITY] Update dependency jsrsasign to v10 [SECURITY] Oct 16, 2025
@renovate
renovate Bot force-pushed the renovate/npm-jsrsasign-vulnerability branch from 99a9aea to 0eee1f4 Compare December 4, 2025 22:26
@renovate
renovate Bot force-pushed the renovate/npm-jsrsasign-vulnerability branch from 0eee1f4 to 7aef588 Compare August 29, 2026 04:34
@renovate renovate Bot changed the title Update dependency jsrsasign to v10 [SECURITY] Update dependency jsrsasign to v11 [SECURITY] Aug 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants