PT-2020-21070 · Unknown · Simple-Crypto-Js

Published 2020-09-03 · Updated 2020-09-03

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions simple-crypto-js versions prior to 2.3.0

Description The issue concerns the use of AES-CBC with PKCS#7 padding, which is susceptible to padding oracle attacks. This could potentially allow attackers to break the encryption and access sensitive data.

Recommendations For simple-crypto-js versions prior to 2.3.0, upgrade to version 2.3.0 or later.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

GHSA-5V7R-JG9R-VQ44

Affected Products

Simple-Crypto-Js

References · 7

• https://osv.dev/vulnerability/GHSA-5v7r-jg9r-vq44 · Vendor Advisory
• https://github.com/danang-id/simple-crypto-js/issues/12 · Note
• https://github.com/danang-id/simple-crypto-js/commit/416584369de1dad9b21ac3fe85df0b71cf5718b2 · Note
• https://github.com/danang-id/simple-crypto-js/pull/17 · Note
• https://github.com/danang-id/simple-crypto-js · Note
• https://robertheaton.com/2013/07/29/padding-oracle-attack · Note
• https://snyk.io/vuln/SNYK-JS-SIMPLECRYPTOJS-544027 · Note