PT-2022-24817 · Unknown · Js Compute Runtime

Elliotttpublished + 1 · Published 2022-09-20 · Updated 2022-09-21 · CVE-2022-39218

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JS Compute Runtime versions prior to 0.5.3

Description The Math.random and crypto.getRandomValues methods fail to use sufficiently random values, making the sequence of random values predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, potentially disclosing sensitive data encrypted by functions that use these generators.

Recommendations For versions prior to 0.5.3, upgrade to version 0.5.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Math.random and crypto.getRandomValues methods until the upgrade is applied. However, it is noted that there are no known workarounds, and upgrading to the patched version is the recommended solution.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-335

CWE-330

Related Identifiers

CVE-2022-39218

GHSA-CMR8-5W4C-44V8

Affected Products

Js Compute Runtime

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39218.json · Exploit
• https://osv.dev/vulnerability/GHSA-cmr8-5w4c-44v8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39218 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39218 · Vendor Advisory
• https://github.com/fastly/js-compute-runtime · Note
• https://github.com/fastly/js-compute-runtime/commit/65524ffc962644e9fc39f4b368a326b6253912a9 · Note
• https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-cmr8-5w4c-44v8 · Note