Marvin Attack of RSA and RSAOAEP decryption in jsrsasign

CVE-2024-21484 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Impact

RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.

Patches

update to jsrsasign 11.0.0.

Workarounds

Find and replace RSA and RSAOAEP decryption with other crypto library.

References

https://people.redhat.com/~hkario/marvin/
https://github.com/kjur/jsrsasign/issues/598
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21484

Basic information

Type
reviewed
Severity
high
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2024-01-19 15:06:07 UTC
Updated
2024-02-27 19:23:59 UTC
GitHub reviewed
2024-01-19 15:06:07 UTC
NVD published
2024-01-22

EPSS Score

Score Percentile
0.24% 46.75%

CVSS Scores

Base score Version Severity Vector
7.5 3.1 —
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:L)
Might cause slowdowns, glitches, or partial disruption—not a full brick.

Identifiers

Type Value
GHSA GHSA-rh63-9qcf-83gf ↗
CVE CVE-2024-21484 ↗

CWEs

CWE id Name
CWE-203 Observable Discrepancy

Credits

  • tomato42 (reporter)

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
npm jsrsasign < 11.0.0 11.0.0 —

References

cvelogic Threat Intelligence