Microsoft Microsoft Research JavaScript Cryptography Library V1.4
At a glance
- Source
- NVD
- EPSS
- EPSS 2.60 % · percentile 85 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- microsoft
- NVD status
- Modified
Description
A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography (ECC) implementation.An attacker could potentially abuse these bugs to learn information about a server’s private ECC key (a key leakage attack) or craft an invalid ECDSA signature that nevertheless passes as valid.The security update addresses the vulnerability by fixing the bugs disclosed in the ECC implementation, aka 'MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability'.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
- CWE-347 — Improper Verification of Cryptographic Signature
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-9x9j-836w-8f55 — Incorrect Calculation in the MSR JavaScript Cryptography Library
European references
- ENISA EUVD · EUVD-2022-0551
- GCVE · GCVE-0-2020-1026
CERT-FR advisories
- CERTFR-2020-AVI-225 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:microsoft:research_javascript_cryptography_library:1.4:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Microsoft · Microsoft Research JavaScript Cryptography Library V1.4 | affected unspecified |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |