Microsoft Microsoft Research JavaScript Cryptography Library V1.4
En bref
- Source
- NVD
- EPSS
- EPSS 2.60 % · centile 85 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- microsoft
- Statut NVD
- Modified
Description
A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography (ECC) implementation.An attacker could potentially abuse these bugs to learn information about a server’s private ECC key (a key leakage attack) or craft an invalid ECDSA signature that nevertheless passes as valid.The security update addresses the vulnerability by fixing the bugs disclosed in the ECC implementation, aka 'MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability'.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
- CWE-347 — Vérification incorrecte d'une signature cryptographique
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-9x9j-836w-8f55 — Incorrect Calculation in the MSR JavaScript Cryptography Library
Références européennes
- ENISA EUVD · EUVD-2022-0551
- GCVE · GCVE-0-2020-1026
Avis du CERT-FR
- CERTFR-2020-AVI-225 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:microsoft:research_javascript_cryptography_library:1.4:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Microsoft · Microsoft Research JavaScript Cryptography Library V1.4 | affected unspecified |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |