Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kjur/jsrsasign

              master @ 5d67719
            

Fixes

CVEs

CRITICAL

Peak severity

40.0%

Coverage

Highlights

Cryptographic Issues: 6 prior fixes. Scrutinize any change in this area.

ext/rsa.js: most-fixed (3 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Issues: Inadequate verification of DSA public domain parameters and key sanity allows for universal signature forgery, which bypasses the entire security guarantee of DSA signature validation.

Auth Bypass: Accepting malformed Base64URL representations in JWS/JWT signatures allows attackers to bypass signature validation entirely due to loose parsing.

Side-Channel Attack: The implementation of RSA PKCS#1 v1.5 and OAEP decryption was historically vulnerable to the Marvin timing side-channel attack, requiring the deprecation or replacement of weak APIs.