Publish Advisories

GHSA-8g7p-jf3g-gxcp
GHSA-w8q8-93cx-6h7r

Author: advisory-database[bot]

…-8g7p-jf3g-gxcp/GHSA-8g7p-jf3g-gxcp.json …-8g7p-jf3g-gxcp/GHSA-8g7p-jf3g-gxcp.jsonadvisories/unreviewed/2026/03/GHSA-8g7p-jf3g-gxcp/GHSA-8g7p-jf3g-gxcp.json renamed to advisories/github-reviewed/2026/03/GHSA-8g7p-jf3g-gxcp/GHSA-8g7p-jf3g-gxcp.json advisories/unreviewed/2026/03/GHSA-8g7p-jf3g-gxcp/GHSA-8g7p-jf3g-gxcp.json renamed to advisories/github-reviewed/2026/03/GHSA-8g7p-jf3g-gxcp/GHSA-8g7p-jf3g-gxcp.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8g7p-jf3g-gxcp",
-  "modified": "2026-03-23T06:30:29Z",
+  "modified": "2026-03-29T15:51:28Z",
   "published": "2026-03-23T06:30:29Z",
   "aliases": [
     "CVE-2026-4598"
   ],
+  "summary": "jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs",
   "details": "Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).",
   "severity": [
     {
@@ -14,10 +15,30 @@
     },
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "jsrsasign"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "11.1.1"
+            }
+          ]
+        }
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -35,6 +56,10 @@
       "type": "WEB",
       "url": "https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/kjur/jsrsasign"
+    },
     {
       "type": "WEB",
       "url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938"
@@ -45,8 +70,8 @@
       "CWE-835"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-03-29T15:51:28Z",
     "nvd_published_at": "2026-03-23T06:16:21Z"
   }
 }

…-w8q8-93cx-6h7r/GHSA-w8q8-93cx-6h7r.json …-w8q8-93cx-6h7r/GHSA-w8q8-93cx-6h7r.jsonadvisories/unreviewed/2026/03/GHSA-w8q8-93cx-6h7r/GHSA-w8q8-93cx-6h7r.json renamed to advisories/github-reviewed/2026/03/GHSA-w8q8-93cx-6h7r/GHSA-w8q8-93cx-6h7r.json advisories/unreviewed/2026/03/GHSA-w8q8-93cx-6h7r/GHSA-w8q8-93cx-6h7r.json renamed to advisories/github-reviewed/2026/03/GHSA-w8q8-93cx-6h7r/GHSA-w8q8-93cx-6h7r.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-w8q8-93cx-6h7r",
-  "modified": "2026-03-23T06:30:29Z",
+  "modified": "2026-03-29T15:51:59Z",
   "published": "2026-03-23T06:30:29Z",
   "aliases": [
     "CVE-2026-4601"
   ],
+  "summary": "jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction",
   "details": "Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.",
   "severity": [
     {
@@ -14,10 +15,30 @@
     },
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N/E:P"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "jsrsasign"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "11.1.1"
+            }
+          ]
+        }
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -35,6 +56,10 @@
       "type": "WEB",
       "url": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/kjur/jsrsasign"
+    },
     {
       "type": "WEB",
       "url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941"
@@ -44,9 +69,9 @@
     "cwe_ids": [
       "CWE-325"
     ],
-    "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-03-29T15:51:59Z",
     "nvd_published_at": "2026-03-23T06:16:21Z"
   }
 }