Skip to content

Commit f7e3698

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-464q-cqxq-xhgr GHSA-4f9r-x588-pp2h GHSA-5jx8-q4cp-rhh6 GHSA-8qwj-4jxw-m8jw GHSA-wvqx-v3f6-w8rh
1 parent 2c647be commit f7e3698

5 files changed

Lines changed: 183 additions & 22 deletions

File tree

advisories/unreviewed/2026/03/GHSA-464q-cqxq-xhgr/GHSA-464q-cqxq-xhgr.json renamed to advisories/github-reviewed/2026/03/GHSA-464q-cqxq-xhgr/GHSA-464q-cqxq-xhgr.json

Lines changed: 31 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-464q-cqxq-xhgr",
4-
"modified": "2026-03-23T18:30:30Z",
4+
"modified": "2026-03-30T19:30:16Z",
55
"published": "2026-03-23T06:30:29Z",
66
"aliases": [
77
"CVE-2026-4603"
88
],
9+
"summary": "jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations",
910
"details": "Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "jsrsasign"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"fixed": "11.1.1"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -35,6 +56,10 @@
3556
"type": "WEB",
3657
"url": "https://gist.github.com/Kr0emer/5366b7364c4fbf7e754bc377f321e9f3"
3758
},
59+
{
60+
"type": "PACKAGE",
61+
"url": "https://github.com/kjur/jsrsasign"
62+
},
3863
{
3964
"type": "WEB",
4065
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371176"
@@ -44,9 +69,9 @@
4469
"cwe_ids": [
4570
"CWE-369"
4671
],
47-
"severity": "MODERATE",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
72+
"severity": "LOW",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-03-30T19:30:16Z",
5075
"nvd_published_at": "2026-03-23T06:16:22Z"
5176
}
5277
}

‎advisories/github-reviewed/2026/03/GHSA-4f9r-x588-pp2h/GHSA-4f9r-x588-pp2h.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4f9r-x588-pp2h",
4+
"modified": "2026-03-30T19:29:13Z",
5+
"published": "2026-03-30T19:29:13Z",
6+
"aliases": [
7+
"CVE-2026-34389"
8+
],
9+
"summary": "Fleet's user account creation via invite does not enforce invited email address",
10+
"details": "### Summary\n\nFleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin.\n\n### Impact\n\nIf an attacker gains access to a valid invite token, they can create a Fleet user account with an email address of their choosing while inheriting the invite’s assigned role and team memberships.\n\nThis issue:\n\n- Requires possession of a valid invite token\n- Does not bypass authentication controls beyond invite-based account creation\n- Does not expose data without successful account creation\n\n### Workarounds\n\nIf upgrading immediately is not possible:\n\n- Treat invite links as sensitive credentials and avoid sharing them in public or semi-public channels (e.g., Slack, Teams).\n- Revoke and reissue invites if there is any concern that an invite link may have been exposed.\n- Prefer issuing invites with the minimum required privileges and elevating roles after account creation when appropriate.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n\nSend an email to [security@fleetdm.com](mailto:security@fleetdm.com)\n\n### Credits\n\nFleet thanks @fuzzztf for responsibly reporting this issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/fleetdm/fleet/v4"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "4.81.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34389"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/fleetdm/fleet"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-287"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-30T19:29:13Z",
59+
"nvd_published_at": "2026-03-27T20:16:35Z"
60+
}
61+
}

advisories/unreviewed/2026/03/GHSA-5jx8-q4cp-rhh6/GHSA-5jx8-q4cp-rhh6.json renamed to advisories/github-reviewed/2026/03/GHSA-5jx8-q4cp-rhh6/GHSA-5jx8-q4cp-rhh6.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5jx8-q4cp-rhh6",
4-
"modified": "2026-03-23T06:30:29Z",
4+
"modified": "2026-03-30T19:29:39Z",
55
"published": "2026-03-23T06:30:29Z",
66
"aliases": [
77
"CVE-2026-4599"
88
],
9+
"summary": "jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation",
910
"details": "Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "jsrsasign"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "7.0.0"
33+
},
34+
{
35+
"fixed": "11.1.1"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -35,6 +56,10 @@
3556
"type": "WEB",
3657
"url": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20"
3758
},
59+
{
60+
"type": "PACKAGE",
61+
"url": "https://github.com/kjur/jsrsasign"
62+
},
3863
{
3964
"type": "WEB",
4065
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939"
@@ -45,8 +70,8 @@
4570
"CWE-1023"
4671
],
4772
"severity": "CRITICAL",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-03-30T19:29:39Z",
5075
"nvd_published_at": "2026-03-23T06:16:21Z"
5176
}
5277
}

advisories/unreviewed/2026/03/GHSA-8qwj-4jxw-m8jw/GHSA-8qwj-4jxw-m8jw.json renamed to advisories/github-reviewed/2026/03/GHSA-8qwj-4jxw-m8jw/GHSA-8qwj-4jxw-m8jw.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8qwj-4jxw-m8jw",
4-
"modified": "2026-03-23T06:30:29Z",
4+
"modified": "2026-03-30T19:30:01Z",
55
"published": "2026-03-23T06:30:29Z",
66
"aliases": [
77
"CVE-2026-4602"
88
],
9+
"summary": "jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass",
910
"details": "Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "jsrsasign"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"fixed": "11.1.1"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -35,6 +56,10 @@
3556
"type": "WEB",
3657
"url": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5"
3758
},
59+
{
60+
"type": "PACKAGE",
61+
"url": "https://github.com/kjur/jsrsasign"
62+
},
3863
{
3964
"type": "WEB",
4065
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175"
@@ -45,8 +70,8 @@
4570
"CWE-681"
4671
],
4772
"severity": "HIGH",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-03-30T19:30:01Z",
5075
"nvd_published_at": "2026-03-23T06:16:22Z"
5176
}
5277
}

advisories/unreviewed/2026/03/GHSA-wvqx-v3f6-w8rh/GHSA-wvqx-v3f6-w8rh.json renamed to advisories/github-reviewed/2026/03/GHSA-wvqx-v3f6-w8rh/GHSA-wvqx-v3f6-w8rh.json

Lines changed: 31 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wvqx-v3f6-w8rh",
4-
"modified": "2026-03-23T06:30:29Z",
4+
"modified": "2026-03-30T19:29:53Z",
55
"published": "2026-03-23T06:30:29Z",
66
"aliases": [
77
"CVE-2026-4600"
88
],
9+
"summary": "jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic",
910
"details": "Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "jsrsasign"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"fixed": "11.1.1"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -35,6 +56,10 @@
3556
"type": "WEB",
3657
"url": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7"
3758
},
59+
{
60+
"type": "PACKAGE",
61+
"url": "https://github.com/kjur/jsrsasign"
62+
},
3863
{
3964
"type": "WEB",
4065
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940"
@@ -44,9 +69,9 @@
4469
"cwe_ids": [
4570
"CWE-347"
4671
],
47-
"severity": "CRITICAL",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
72+
"severity": "HIGH",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-03-30T19:29:53Z",
5075
"nvd_published_at": "2026-03-23T06:16:21Z"
5176
}
5277
}

0 commit comments

Comments
 (0)