PT-2023-29917 · Pypi+5 · Crypto-Js+5

Zemnmez · Published 2023-10-25 · Updated 2025-12-16 · CVE-2023-46233

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions crypto-js versions prior to 4.2.0

Description The crypto-js library has a weakened PBKDF2 configuration, which is 1,000 times weaker than originally specified in 1993 and at least 1,300,000 times weaker than the current industry standard. This is due to the default use of the insecure SHA1 hashing algorithm and a single iteration. The impact is high if used to protect passwords or generate signatures. The library has 10,642 public users, and the number of transient dependents is likely several orders of magnitude higher. A rough GitHub search shows 432 files using PBKDF2 in crypto-js without specifying any number of iterations.

Recommendations For versions prior to 4.2.0, configure crypto-js to use SHA256 with at least 250,000 iterations as a workaround. Update to version 4.2.0, which contains a patch for this issue.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-916

CWE-328

CWE-327

Related Identifiers

CESA-2024_0157

CESA-2024_0158

CESA-2024_0806

CVE-2023-46233

DLA-3669-1

GHSA-XWCQ-PM8M-C4VF

RHSA-2024:0151

RHSA-2024:0156

RHSA-2024:0157

RHSA-2024:0158

RHSA-2024:0805

RHSA-2024:0806

RHSA-2024_0151

RHSA-2024_0156

RHSA-2024_0157

RHSA-2024_0158

RHSA-2024_0805

RHSA-2024_0806

USN-6753-1

Affected Products

Centos

Debian

Linuxmint

Red Hat

Ubuntu

Crypto-Js

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46233.json · Exploit
• https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a · Patch
• https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6753-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46233 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2023-46233 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46233 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-46233 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3669-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-46233 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6753-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xwcq-pm8m-c4vf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46233 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46233 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-46233 · Security Note