Kr0Emer

**Name of the Vulnerable Software and Affected Versions** node-forge versions prior to 1.4.0 **Description** A Denial of Service (DoS) issue exists in the node-forge library due to an infinite loop within the BigInteger.modInverse() function, inherited from the bundled jsbn library. When modInverse() is called with a zero value as input, the Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. This can occur if the application processes untrusted input that reaches the modInverse() function, potentially impacting applications utilizing DSA/ECDSA signature verification, custom RSA or Diffie-Hellman implementations, or other cryptographic protocols where an attacker can influence values passed to modInverse(). A single malicious request can cause the Node.js event loop to block, rendering the application unresponsive. **Recommendations** Versions prior to 1.4.0: Upgrade to version 1.4.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** jsrsasign versions prior to 11.1.1 **Description** An infinite loop occurs via the `bnModInverse()` function in ext/jsbn2.js when the `BigInteger.modInverse` implementation receives zero or negative inputs. This allows an attacker to permanently hang the process by supplying crafted values, such as `modInverse(0, m)` or `modInverse(-1, m)`. **Recommendations** Update to version 11.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** jsrsasign versions 7.0.0 through 11.1.1 **Description** An issue exists involving incomplete comparison with missing factors within the `getRandomBigIntegerZeroToMax()` and `getRandomBigIntegerMinToMax()` functions located in src/crypto-1.1.js. An attacker can recover the private key by exploiting incorrect `compareTo` checks that accept out-of-range candidates, which biases DSA nonces during the signature generation process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** jsrsasign versions prior to 11.1.1 **Description** Improper verification of cryptographic signatures occurs due to flawed DSA domain-parameter validation in the `KJUR.crypto.DSA.setPublic()` function and the associated DSA/X509 verification flow in `src/dsa-2.0.js`. An attacker can forge DSA signatures or X.509 certificates that the `X509.verifySignature()` function accepts by providing malicious domain parameters, specifically `g=1`, `y=1`, and a fixed `r=1`, which causes the verification equation to be true for any hash. **Recommendations** Update jsrsasign to version 11.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** jsrsasign versions prior to 11.1.1 **Description** Incorrect Conversion between Numeric Types occurs due to the handling of negative exponents in the file ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling the `modPow()` function with a negative exponent. **Recommendations** Update to version 11.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** jsrsasign versions prior to 11.1.1 **Description** The jsrsasign package contains a flaw related to division by zero. This issue stems from the RSASetPublic/KEYUTIL parsing path within the 'ext/rsa.js' file and the BigInteger.modPowInt reduction logic in 'ext/jsbn.js'. An attacker can exploit this by providing a JSON Web Key (JWK) with a modulus that decodes to zero, causing RSA public-key operations, such as verification and encryption, to produce deterministic zero outputs and conceal “invalid key” errors. **Recommendations** Update jsrsasign to version 11.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** jsrsasign versions prior to 11.1.1 **Description** A missing cryptographic step in the DSA signing implementation occurs during the `KJUR.crypto.DSA.signWithMessageHash()` process. An attacker can recover the private key by forcing the variables `r` or `s` to be zero, which causes the library to emit an invalid signature without retrying. The attacker can then solve for `x` using the resulting signature to obtain the private key. **Recommendations** Update to version 11.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** sjcl (affected versions not specified) **Description** The software is susceptible to an Improper Verification of Cryptographic Signature issue due to missing point-on-curve validation within the `sjcl.ecc.basicKey.publicKey()` function. An attacker can potentially recover a victim's ECDH private key by sending specifically crafted off-curve public keys and monitoring ECDH outputs. The `dhJavaEc()` function directly returns the raw x-coordinate of the scalar multiplication result without hashing, which creates a plaintext oracle without requiring decryption feedback. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** bn.js versions prior to 5.2.3 **Description** The bn.js package is susceptible to a state corruption issue. Calling the `maskn(0)` function on any BN instance corrupts the internal state. This corruption causes methods like `toString()`, `divmod()`, and others to enter an infinite loop, resulting in a process hang. **Recommendations** Update bn.js to version 5.2.3 or later.