{"id":"CVE-2020-14967","aliases":["EUVD-2020-0526","GHSA-xxxq-chmp-67g4"],"status":"published","title":"RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign","description":"An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02327,"percentile":0.83631,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2020-06-22T11:19:35Z","modified":"2026-10-20T10:51:51Z","fixes":[{"ecosystem":"npm","package":"jsrsasign","fixed_in":["8.0.18"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jsrsasign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.18"}]}]},{"source":"osv","ecosystem":"npm","package":"jsrsasign","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.0.18"}]}]}],"products":[{"vendor":"kjur","product":"jsrsasign"},{"vendor":"netapp","product":"max_data"}],"references":[{"url":"https://kjur.github.io/jsrsasign/","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://www.npmjs.com/package/jsrsasign","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory","web"]},{"url":"https://github.com/kjur/jsrsasign/releases/tag/8.0.18","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/kjur/jsrsasign/releases/tag/8.0.17","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/kjur/jsrsasign/issues/439","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20200724-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/kjur/jsrsasign/security/advisories/GHSA-xxxq-chmp-67g4","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14967","tags":["advisory"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14967","tags":["web"]},{"url":"https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.Cipher.html#.decrypt","tags":["web"]},{"url":"https://vuldb.com/?id.157124","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xxxq-chmp-67g4"},{"url":"https://github.com/kjur/jsrsasign","tags":["package"]},{"url":"https://kjur.github.io/jsrsasign","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20200724-0001","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-14967","description":"An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.","status":"published","published":"2020-06-22T11:19:35Z","modified":"2024-08-04T13:00:52.09Z","updated_at":"2026-11-02T14:35:46.873079Z"}],"euvd":[{"id":"EUVD-2020-0526","description":"An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.","status":"published","published":"2020-06-22T11:19:35Z","modified":"2024-08-04T13:00:52Z","updated_at":"2026-11-03T03:07:33.617168Z"}],"ghsa":[{"id":"GHSA-xxxq-chmp-67g4","title":"RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign","description":"### Impact\nJsrsasign supports RSA PKCS#1 v1.5 (i.e. RSAES-PKCS1-v1_5) and RSA-OAEP encryption and decryption. Its encrypted message is represented as BigInteger. When there is a valid encrypted message, a crafted message with prepending zeros can be decrypted by this vulnerability.\n\n- If you don't use RSA PKCS1-v1_5 or RSA-OAEP decryption, this vulnerability is not affected.\n- Risk to forge contents of encrypted message is very low.\n- Risk to raise memory corruption is low since jsrsasign uses BigInteger class.\n\n### Patches\nUsers using RSA PKCS1-v1_5 or RSA-OAEP decryption should upgrade to 8.0.18.\n\n### Workarounds\nReject RSA PKCS1-v1_5 or RSA-OAEP encrypted message with unnecessary prepending zeros.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-14967\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14967\nhttps://vuldb.com/?id.157124\nhttps://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.Cipher.html#.decrypt\nhttps://github.com/kjur/jsrsasign/issues/439\n\n\n\n","status":"published","published":"2020-06-26T16:27:08Z","modified":"2023-01-31T01:29:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:36:28.424013Z"}],"nvd":[{"id":"CVE-2020-14967","description":"An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.","status":"published","published":"2020-06-22T12:15:10.15Z","modified":"2026-06-22T03:18:31.867Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:06:07.249892Z"}],"osv":[{"id":"CVE-2020-14967","description":"An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.","status":"published","published":"2020-06-22T12:15:10.15Z","modified":"2026-10-20T10:51:51.952099864Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"GHSA-xxxq-chmp-67g4","title":"RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign","description":"### Impact\nJsrsasign supports RSA PKCS#1 v1.5 (i.e. RSAES-PKCS1-v1_5) and RSA-OAEP encryption and decryption. Its encrypted message is represented as BigInteger. When there is a valid encrypted message, a crafted message with prepending zeros can be decrypted by this vulnerability.\n\n- If you don't use RSA PKCS1-v1_5 or RSA-OAEP decryption, this vulnerability is not affected.\n- Risk to forge contents of encrypted message is very low.\n- Risk to raise memory corruption is low since jsrsasign uses BigInteger class.\n\n### Patches\nUsers using RSA PKCS1-v1_5 or RSA-OAEP decryption should upgrade to 8.0.18.\n\n### Workarounds\nReject RSA PKCS1-v1_5 or RSA-OAEP encrypted message with unnecessary prepending zeros.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-14967\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14967\nhttps://vuldb.com/?id.157124\nhttps://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.Cipher.html#.decrypt\nhttps://github.com/kjur/jsrsasign/issues/439\n\n\n\n","status":"published","published":"2020-06-26T16:27:08Z","modified":"2023-11-08T04:02:28.135196Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:47:00.604718Z"}]}}