CVE-2024-21484

Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.

• CWE-203
• CWE-203

• https://github.com/kjur/jsrsasign/issues/598Exploit, Issue Tracking, Vendor Advisory
• https://github.com/kjur/jsrsasign/releases/tag/11.0.0Patch, Release Notes
• https://people.redhat.com/~hkario/marvin/
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6070734Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-6070733Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-6070731Patch, Third Party Advisory
• https://github.com/kjur/jsrsasign/issues/598Exploit, Issue Tracking, Vendor Advisory
• https://github.com/kjur/jsrsasign/releases/tag/11.0.0Patch, Release Notes
• https://people.redhat.com/~hkario/marvin/
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6070734Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-6070733Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-6070731Patch, Third Party Advisory

Published

Jan 22, 2024

Last Modified

Jun 22, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21479Transient DOS during music playback of ALAC content.7.5
• CVE-2024-2148A vulnerability classified as critical has been found in Sou…8.8
• CVE-2024-21480Memory corruption while playing audio file having large-size…9.8
• CVE-2024-21481Memory corruption when preparing a shared memory notificatio…8.4
• CVE-2024-21482Memory corruption during the secure boot process, when the `…7.8
• CVE-2024-21483A vulnerability has been identified in SENTRON 7KM PAC3120 A…5.1
• CVE-2024-21485Versions of the package dash-core-components before 2.13.0; …5.4
• CVE-2024-21488Versions of the package network before 0.7.0 are vulnerable …9.8
• CVE-2024-21489Versions of the package uplot before 1.6.31 are vulnerable t…8.2
• CVE-2024-2149A vulnerability classified as critical was found in CodeAstr…7.2
• CVE-2024-21490This affects versions of the package angular from 1.3.0; ver…7.5
• CVE-2024-21491Versions of the package svix before 1.17.0 are vulnerable to…6.5