$ cve CVE-2020-14968 JSON

CVE-2020-14968

9.8

CRITICAL · CVSS 3.1 · EPSS 2.9% (pctl 86)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending '\0' bytes to a signature (it accepts these modified signatures as valid). An attacker can abuse this behavior in an application by creating multiple valid signatures where only one signature should exist. Also, an attacker might prepend these bytes with the goal of triggering memory corruption issues.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	2.86% — more likely to be exploited than 86% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	none known
Published	2020-06-22
Last modified	2026-06-22

Affected (2)

Vendor	Product
kjur	jsrsasign
netapp	max data

References

→ the Explorer · watch your stack · NVD