PT-2018-9474 · Hapi+1 · @Hapi/Cryptiles+1

Hueniverse · Published 2018-07-09 · Updated 2023-03-31 · CVE-2018-1000620

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eran Hammer cryptiles versions 4.1.1 and earlier

Description The issue is related to insufficient entropy in the randomDigits() method, which can result in an increased likelihood of brute force attacks. This attack appears to be exploitable depending on the calling application.

Recommendations For versions 4.1.1 and earlier, upgrade to version 4.1.2 to resolve the issue. Note that the package is deprecated and has been moved to @hapi/cryptiles, and it is strongly recommended to use the maintained package.

Fix

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2018-1000620

GHSA-RQ8G-5PC5-WRHR

Affected Products

@Hapi/Cryptiles

Cryptiles

References · 14

• https://github.com/hapijs/cryptiles/issues/34 · Patch
• https://osv.dev/vulnerability/GHSA-rq8g-5pc5-wrhr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000620 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000620 · Vendor Advisory
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/476.json · Note
• https://github.com/hapijs/cryptiles/commit/cb6bd642816e0cb8341d2b3896fd9e7c57e94f56 · Note
• https://github.com/hapijs/cryptiles/commit/9332d4263a32b84e76bf538d7470d01ea63fa047 · Note
• https://github.com/hapijs/cryptiles/commit/6bdcd0f6ee8ade96e7b30350bad39ee0c2ef0f9b · Note
• https://github.com/hapijs/cryptiles/issues/35 · Note
• https://github.com/hapijs/cryptiles · Note
• https://github.com/advisories/GHSA-rq8g-5pc5-wrhr · Note
• https://npmjs.com/advisories/720 · Note
• https://t.me/cvenotify/47279 · Telegram Post
• https://npmjs.com/advisories/1464 · Note