CVE-2022-35255
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src...
Original description
The description as published by the source.
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
Affected packages
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"15.0.0"},{"fixed":"15.14.1"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.17.1"},{"introduced":"18.0.0"},{"fixed":"18.9.1"}]}]
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"15.0.0"},{"fixed":"15.14.1"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.17.1"},{"introduced":"18.0.0"},{"fixed":"18.9.1"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2022-35255 nodejs Fixed in: 16.17.1-r0
- Debian DEBIAN-CVE-2022-35255 nodejs Fixed in: 12.22.12~dfsg-1~deb11u3
References
- advisory security.netapp.com
- advisory debian.org
- advisory nvd.nist.gov
- advisory github.com
- web hackerone.com
- web cert-portal.siemens.com