In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:kjur:jsrsasign:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "10.1.13"
}
],
"source": "CPE_RANGE"
},
{
"original_tag": "10.1.13",
"range": [
{
"fixed": "482e651f2bb380dad3da4bbf0ae220fe3021d407"
}
],
"source": "REFERENCES_TAG"
}
]
}