PT-2022-18971 · Scala.Js · Scala.Js

Armanbilge · Published 2022-04-02 · Updated 2022-04-11 · CVE-2022-28355

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Scala.js versions prior to 1.10.0

Description The issue concerns the generation of predictable values by the randomUUID function in Scala.js. This predictability can potentially be exploited.

Recommendations For versions prior to 1.10.0, update to version 1.10.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the randomUUID function until a patch is applied.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2022-28355

GHSA-J2F9-W8WH-9WW4

Affected Products

Scala.Js

References · 10

• https://github.com/scala-js/scala-js/issues/4657 · Patch
• https://osv.dev/vulnerability/CVE-2022-28355 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28355 · Security Note
• https://github.com/scala-js/scala-js/security/advisories/GHSA-j2f9-w8wh-9ww4 · Note
• https://github.com/scala-js/scala-js/releases · Note
• https://t.me/cibsecurity/40065 · Telegram Post
• https://scala-js.org/news/2022/04/04/announcing-scalajs-1.10.0 · Note
• https://t.me/cvenotify/28361 · Telegram Post
• https://t.me/cvenotify/28441 · Telegram Post
• https://t.me/cvenotify/28343 · Telegram Post