SNYK-JS-JSRSASIGN-6070731

## Overview [jsrsasign](https://www.npmjs.com/package/jsrsasign) is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Observable Discrepancy via the RSA PKCS#1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. ## Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library. ## Remediation Upgrade `jsrsasign` to version 11.0.0 or higher. ## References - [GitHub Commit](https://github.com/kjur/jsrsasign/releases/tag/11.0.0) - [GitHub Issue](https://github.com/kjur/jsrsasign/issues/598) - [Vulnerability Report](https://people.redhat.com/~hkario/marvin/)