[GHSA-q3gh-5r98-j4h3] RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign

[nikpivkin]

Updates

• Affected products

Comments
The range should end at < 8.0.17, not < 8.0.16.

The fix kjur/jsrsasign@3bcc088 is in tag 8.0.17 and not in tag 8.0.16.

So version 8.0.16 is still vulnerable but is outside the current range.

[github]

Hi there @kjur! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Copilot review overview

🟡 Changes recommended

The affected-version range must be retained and corrected to < 8.0.17.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Preserve and update affected version range to < 8.0.17 · New

What changed in this PR

Updates the jsrsasign advisory’s affected-version metadata for the RSA-PSS vulnerability.

Changes:

• Updates the advisory modification timestamp.
• Removes last_known_affected_version_range instead of correcting it to < 8.0.17.

File	Description
advisories/​github-reviewed/​2020/​06/​GHSA-q3gh-5r98-j4h3/​GHSA-q3gh-5r98-j4h3.json	Updates advisory metadata and affected-version information.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The advisory correction is consistent and has no unresolved issues.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Preserve and update affected version range to < 8.0.17