CVE search · CVE-2022-35255
CVE-2022-35255
critical 9.1
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
Details
- Status
- Modified
- Published
- Last changed
- Source
- support@hackerone.com
- Weakness
- CWE-338
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | critical 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
nvd@nist.govPrimary |
| CVSS 3.1 | critical 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdfThird Party Advisory
- https://hackerone.com/reports/1690000ExploitIssue TrackingThird Party Advisory
- https://security.netapp.com/advisory/ntap-20230113-0002/Third Party Advisory
- https://www.debian.org/security/2023/dsa-5326Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdfThird Party Advisory
- https://hackerone.com/reports/1690000ExploitIssue TrackingThird Party Advisory
- https://security.netapp.com/advisory/ntap-20230113-0002/Third Party Advisory
- https://www.debian.org/security/2023/dsa-5326Third Party Advisory