SecuriTricks - CVE-2025-45764

Description

jsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs can be assigned for key lengths in specific applications that use a library, and should not be assigned to the default key lengths in a library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.

Product(s) Impacted

Vendor	Product	Versions
Jsrsasign	Jsrsasign	11.1.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	jsrsasign	jsrsasign	11.1.0	/	/	/	/	/	/	/

References

https://gist.github.com/ZupeiNie/2250cf1758771d56272dc326ce066202

https://github.com/kjur/jsrsasign/issues/634

CVSS Score

3.2 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: HIGH
Privileges Required: NONE
Scope: CHANGED
Confidentiality Impact: NONE
Integrity Impact: LOW
Availability Impact: NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

View Vector String

Timeline

Published: Aug. 6, 2025, 8:15 p.m.
Last Modified: Aug. 7, 2025, 5:15 a.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cve@mitre.org

CVE-2025-45764