PT-2018-9474 · Hapi+1 · @Hapi/Cryptiles+1

Hueniverse · Publicado 2018-07-09 · Atualizado 2023-03-31 · CVE-2018-1000620

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eran Hammer cryptiles versions 4.1.1 and earlier

Description The issue is related to insufficient entropy in the randomDigits() method, which can result in an increased likelihood of brute force attacks. This attack appears to be exploitable depending on the calling application.

Recommendations For versions 4.1.1 and earlier, upgrade to version 4.1.2 to resolve the issue. Note that the package is deprecated and has been moved to @hapi/cryptiles, and it is strongly recommended to use the maintained package.

Correção

Enumeração de Fraquezas

CWE-331

Identificadores relacionados

CVE-2018-1000620

GHSA-RQ8G-5PC5-WRHR

Produtos afetados

@Hapi/Cryptiles

Cryptiles

Referências · 14

• https://github.com/nodejs/security-wg/blob/master/vuln/npm/476.json · Nota
• https://github.com/hapijs/cryptiles/commit/cb6bd642816e0cb8341d2b3896fd9e7c57e94f56 · Nota
• https://github.com/hapijs/cryptiles/issues/34 · Correção
• https://github.com/hapijs/cryptiles/commit/9332d4263a32b84e76bf538d7470d01ea63fa047 · Nota
• https://github.com/hapijs/cryptiles/commit/6bdcd0f6ee8ade96e7b30350bad39ee0c2ef0f9b · Nota
• https://github.com/hapijs/cryptiles/issues/35 · Nota
• https://github.com/hapijs/cryptiles · Nota
• https://osv.dev/vulnerability/GHSA-rq8g-5pc5-wrhr · Aviso do Fabricante
• https://github.com/advisories/GHSA-rq8g-5pc5-wrhr · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000620 · Nota de Segurança
• https://npmjs.com/advisories/720 · Nota
• https://osv.dev/vulnerability/CVE-2018-1000620 · Aviso do Fabricante
• https://t.me/cvenotify/47279 · Publicação no Telegram
• https://npmjs.com/advisories/1464 · Nota