11.1.1 release

Author: kjur

ChangeLog.txt

@@ -1,6 +1,12 @@
 
 ChangeLog for jsrsasign
 
+* Changes from 11.1.0 to 11.1.1 (2026-Feb-20)
+  - security fix for DSA and BigInteger
+    - PR #651, #650, #649, #648, #647, #646, #645. Thank you @Kr0remer
+    - After assigned CVE number reports will be added.
+  - SECURITY.md added. Thank you @njg7194 
+
 restore KJUR.crypto.Cipher class without RSA/RSAOAEP support
 * Changes from 11.0.0 to 11.1.0 (2024-Feb-01)
   - src/crypto.js

SECURITY.md

@@ -10,7 +10,7 @@ The jsrsasign library is a cryptography library used in many production applicat
 
 Instead, please report them via:
 1. GitHub's private vulnerability reporting feature
-2. Direct email to the maintainer
+2. Direct email to the maintainer (kenji.urushima at gmail.com)
 
 ### What to Include
 

api/symbols/global__.html

@@ -3404,7 +3404,7 @@ <h1 class="classTitle">
 					<pre class="code">inttohex(1) &rarr; "01"
 inttohex(-1) &rarr; "ff"
 inttohex(2048) &rarr; "0800"
-inttohex(-2048) &rarr; "f800"</pre>
+inttohex(-2048) &rarr; "f800ff"</pre>
 
 
 

api/symbols/src/asn1tsp-1.0.js.html

@@ -784,7 +784,7 @@
 <span class='line'>777</span> </span><span class="WHIT">    </span><span class="NAME">this.tohex</span><span class="WHIT"> </span><span class="PUNC">=</span><span class="WHIT"> </span><span class="KEYW">function</span><span class="PUNC">(</span><span class="PUNC">)</span><span class="WHIT"> </span><span class="PUNC">{</span><span class="WHIT">
 <span class='line'>778</span> </span><span class="WHIT">	</span><span class="KEYW">var</span><span class="WHIT"> </span><span class="NAME">params</span><span class="WHIT"> </span><span class="PUNC">=</span><span class="WHIT"> </span><span class="NAME">this.params</span><span class="PUNC">;</span><span class="WHIT">
 <span class='line'>779</span> 
-<span class='line'>780</span> </span><span class="WHIT">	</span><span class="KEYW">if</span><span class="WHIT"> </span><span class="PUNC">(</span><span class="PUNC">!</span><span class="WHIT"> </span><span class="NAME">params</span><span class="WHIT"> </span><span class="KEYW">instanceof</span><span class="WHIT"> </span><span class="NAME">Array</span><span class="PUNC">)</span><span class="WHIT">
+<span class='line'>780</span> </span><span class="WHIT">	</span><span class="KEYW">if</span><span class="WHIT"> </span><span class="PUNC">(</span><span class="PUNC">!</span><span class="WHIT"> </span><span class="PUNC">(</span><span class="NAME">params</span><span class="WHIT"> </span><span class="KEYW">instanceof</span><span class="WHIT"> </span><span class="NAME">Array</span><span class="PUNC">)</span><span class="PUNC">)</span><span class="WHIT">
 <span class='line'>781</span> </span><span class="WHIT">	    </span><span class="KEYW">throw</span><span class="WHIT"> </span><span class="KEYW">new</span><span class="WHIT"> </span><span class="NAME">_Error</span><span class="PUNC">(</span><span class="STRN">"wrong params: not array"</span><span class="PUNC">)</span><span class="PUNC">;</span><span class="WHIT">
 <span class='line'>782</span> 
 <span class='line'>783</span> </span><span class="WHIT">	</span><span class="KEYW">var</span><span class="WHIT"> </span><span class="NAME">a</span><span class="WHIT"> </span><span class="PUNC">=</span><span class="WHIT"> </span><span class="PUNC">[</span><span class="PUNC">]</span><span class="PUNC">;</span><span class="WHIT">

api/symbols/src/base64x-1.1.js.html

@@ -1772,7 +1772,7 @@
 <span class='line'>1765</span>  * inttohex(1) &rarr; "01"
 <span class='line'>1766</span>  * inttohex(-1) &rarr; "ff"
 <span class='line'>1767</span>  * inttohex(2048) &rarr; "0800"
-<span class='line'>1768</span>  * inttohex(-2048) &rarr; "f800"
+<span class='line'>1768</span>  * inttohex(-2048) &rarr; "f800ff"
 <span class='line'>1769</span>  */</span><span class="WHIT">
 <span class='line'>1770</span> </span><span class="KEYW">function</span><span class="WHIT"> </span><span class="NAME">inttohex</span><span class="PUNC">(</span><span class="NAME">i</span><span class="PUNC">)</span><span class="WHIT"> </span><span class="PUNC">{</span><span class="WHIT">
 <span class='line'>1771</span> </span><span class="WHIT">    </span><span class="KEYW">var</span><span class="WHIT"> </span><span class="NAME">bi</span><span class="WHIT"> </span><span class="PUNC">=</span><span class="WHIT"> </span><span class="KEYW">new</span><span class="WHIT"> </span><span class="NAME">BigInteger</span><span class="PUNC">(</span><span class="NAME">String</span><span class="PUNC">(</span><span class="NAME">i</span><span class="PUNC">)</span><span class="PUNC">,</span><span class="WHIT"> </span><span class="NUMB">10</span><span class="PUNC">)</span><span class="PUNC">;</span><span class="WHIT">

api/symbols/src/crypto-1.1.js.html

@@ -398,7 +398,7 @@
 <span class='line'>391</span> </span><span class="WHIT">    </span><span class="KEYW">var</span><span class="WHIT"> </span><span class="NAME">bitLenMax</span><span class="WHIT"> </span><span class="PUNC">=</span><span class="WHIT"> </span><span class="NAME">biMax.bitLength</span><span class="PUNC">(</span><span class="PUNC">)</span><span class="PUNC">;</span><span class="WHIT">
 <span class='line'>392</span> </span><span class="WHIT">    </span><span class="KEYW">while</span><span class="WHIT"> </span><span class="PUNC">(</span><span class="NUMB">1</span><span class="PUNC">)</span><span class="WHIT"> </span><span class="PUNC">{</span><span class="WHIT">
 <span class='line'>393</span> </span><span class="WHIT">	</span><span class="KEYW">var</span><span class="WHIT"> </span><span class="NAME">biRand</span><span class="WHIT"> </span><span class="PUNC">=</span><span class="WHIT"> </span><span class="NAME">KJUR.crypto.Util.getRandomBigIntegerOfNbits</span><span class="PUNC">(</span><span class="NAME">bitLenMax</span><span class="PUNC">)</span><span class="PUNC">;</span><span class="WHIT">
-<span class='line'>394</span> </span><span class="WHIT">	</span><span class="KEYW">if</span><span class="WHIT"> </span><span class="PUNC">(</span><span class="NAME">biMax.compareTo</span><span class="PUNC">(</span><span class="NAME">biRand</span><span class="PUNC">)</span><span class="WHIT"> </span><span class="PUNC">!=</span><span class="WHIT"> </span><span class="PUNC">-</span><span class="NUMB">1</span><span class="PUNC">)</span><span class="WHIT"> </span><span class="KEYW">return</span><span class="WHIT"> </span><span class="NAME">biRand</span><span class="PUNC">;</span><span class="WHIT">
+<span class='line'>394</span> </span><span class="WHIT">	</span><span class="KEYW">if</span><span class="WHIT"> </span><span class="PUNC">(</span><span class="NAME">biMax.compareTo</span><span class="PUNC">(</span><span class="NAME">biRand</span><span class="PUNC">)</span><span class="WHIT"> </span><span class="PUNC">>=</span><span class="WHIT"> </span><span class="NUMB">0</span><span class="PUNC">)</span><span class="WHIT"> </span><span class="KEYW">return</span><span class="WHIT"> </span><span class="NAME">biRand</span><span class="PUNC">;</span><span class="WHIT">
 <span class='line'>395</span> </span><span class="WHIT">    </span><span class="PUNC">}</span><span class="WHIT">
 <span class='line'>396</span> </span><span class="PUNC">}</span><span class="PUNC">;</span><span class="WHIT">
 <span class='line'>397</span> 
@@ -422,7 +422,7 @@
 <span class='line'>415</span>  */</span><span class="WHIT">
 <span class='line'>416</span> </span><span class="NAME">KJUR.crypto.Util.getRandomBigIntegerMinToMax</span><span class="WHIT"> </span><span class="PUNC">=</span><span class="WHIT"> </span><span class="KEYW">function</span><span class="PUNC">(</span><span class="NAME">biMin</span><span class="PUNC">,</span><span class="WHIT"> </span><span class="NAME">biMax</span><span class="PUNC">)</span><span class="WHIT"> </span><span class="PUNC">{</span><span class="WHIT">
 <span class='line'>417</span> </span><span class="WHIT">    </span><span class="KEYW">var</span><span class="WHIT"> </span><span class="NAME">flagCompare</span><span class="WHIT"> </span><span class="PUNC">=</span><span class="WHIT"> </span><span class="NAME">biMin.compareTo</span><span class="PUNC">(</span><span class="NAME">biMax</span><span class="PUNC">)</span><span class="PUNC">;</span><span class="WHIT">
-<span class='line'>418</span> </span><span class="WHIT">    </span><span class="KEYW">if</span><span class="WHIT"> </span><span class="PUNC">(</span><span class="NAME">flagCompare</span><span class="WHIT"> </span><span class="PUNC">==</span><span class="WHIT"> </span><span class="NUMB">1</span><span class="PUNC">)</span><span class="WHIT"> </span><span class="KEYW">throw</span><span class="WHIT"> </span><span class="STRN">"biMin is greater than biMax"</span><span class="PUNC">;</span><span class="WHIT">
+<span class='line'>418</span> </span><span class="WHIT">    </span><span class="KEYW">if</span><span class="WHIT"> </span><span class="PUNC">(</span><span class="NAME">flagCompare</span><span class="WHIT"> </span><span class="PUNC">></span><span class="WHIT"> </span><span class="NUMB">0</span><span class="PUNC">)</span><span class="WHIT"> </span><span class="KEYW">throw</span><span class="WHIT"> </span><span class="STRN">"biMin is greater than biMax"</span><span class="PUNC">;</span><span class="WHIT">
 <span class='line'>419</span> </span><span class="WHIT">    </span><span class="KEYW">if</span><span class="WHIT"> </span><span class="PUNC">(</span><span class="NAME">flagCompare</span><span class="WHIT"> </span><span class="PUNC">==</span><span class="WHIT"> </span><span class="NUMB">0</span><span class="PUNC">)</span><span class="WHIT"> </span><span class="KEYW">return</span><span class="WHIT"> </span><span class="NAME">biMin</span><span class="PUNC">;</span><span class="WHIT">
 <span class='line'>420</span> 
 <span class='line'>421</span> </span><span class="WHIT">    </span><span class="KEYW">var</span><span class="WHIT"> </span><span class="NAME">biDiff</span><span class="WHIT"> </span><span class="PUNC">=</span><span class="WHIT"> </span><span class="NAME">biMax.subtract</span><span class="PUNC">(</span><span class="NAME">biMin</span><span class="PUNC">)</span><span class="PUNC">;</span><span class="WHIT">