search

travist / jsencrypt

A zero-dependency Javascript library to perform OpenSSL RSA Encryption, Decryption, and Key Generation.
http://www.travistidwell.com/jsencrypt
Other
6.65k stars 2.01k forks source link

Bug in rsa.js #69

Open calve opened 8 years ago

calve commented 8 years ago

Hello,

I have found a bug in jsbn rsa.js which might lead to a security vulnerability in jsencrypt (http://www-cs-students.stanford.edu/~tjw/jsbn/rsa.js).

I have a patch to submit.

Is there a specific procedure to report it ?

I already mailed the author of the original jsbn library, but my mail get rejected by the server. Maybe someone knows another contact ?

zoloft commented 8 years ago

It would be great if you could submit the patch to both this repository and zoloft/jsencrypt-core-libs (that will be the base for the next version of jsencrypt)

calve commented 8 years ago

Have a look at #75 and zoloft/jsencrypt-core-libs/pull/2

calve commented 8 years ago

Any update on this ? Let me know if I can help.