CVE-2020-14966

An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.

• CWE-347

• https://github.com/kjur/jsrsasign/issues/437Exploit, Issue Tracking, Third Party Advisory
• https://github.com/kjur/jsrsasign/releases/tag/8.0.17Release Notes, Third Party Advisory
• https://github.com/kjur/jsrsasign/releases/tag/8.0.18Release Notes, Third Party Advisory
• https://kjur.github.io/jsrsasign/Release Notes, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200724-0001/Third Party Advisory
• https://www.npmjs.com/package/jsrsasignProduct, Third Party Advisory
• https://github.com/kjur/jsrsasign/issues/437Exploit, Issue Tracking, Third Party Advisory
• https://github.com/kjur/jsrsasign/releases/tag/8.0.17Release Notes, Third Party Advisory
• https://github.com/kjur/jsrsasign/releases/tag/8.0.18Release Notes, Third Party Advisory
• https://kjur.github.io/jsrsasign/Release Notes, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200724-0001/Third Party Advisory
• https://www.npmjs.com/package/jsrsasignProduct, Third Party Advisory

Published

Jun 22, 2020

Last Modified

Jun 22, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14959Multiple XSS vulnerabilities in the Easy Testimonials plugin…5.4
• CVE-2020-1496A remote code execution vulnerability exists in Microsoft Ex…8.8
• CVE-2020-14960A SQL injection vulnerability in PHP-Fusion 9.03.50 affects …7.2
• CVE-2020-14961Concrete5 before 8.5.3 does not constrain the sort direction…5.3
• CVE-2020-14962Multiple XSS vulnerabilities in the Final Tiles Gallery plug…5.4
• CVE-2020-14965On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attack…4.8
• CVE-2020-14967An issue was discovered in the jsrsasign package before 8.0.…9.8
• CVE-2020-14968An issue was discovered in the jsrsasign package before 8.0.…9.8
• CVE-2020-14969app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup …7.5
• CVE-2020-1497An information disclosure vulnerability exists when Microsof…5.5
• CVE-2020-14971Pi-hole through 5.0 allows code injection in piholedhcp (the…7.8
• CVE-2020-14972Multiple SQL injection vulnerabilities in Sourcecodester Pis…9.8