CVE-2022-35255
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
Paquets affectés
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"15.0.0"},{"fixed":"15.14.1"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.17.1"},{"introduced":"18.0.0"},{"fixed":"18.9.1"}]}]
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"15.0.0"},{"fixed":"15.14.1"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.17.1"},{"introduced":"18.0.0"},{"fixed":"18.9.1"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2022-35255 nodejs Corrigé dans: 16.17.1-r0
- Debian DEBIAN-CVE-2022-35255 nodejs Corrigé dans: 12.22.12~dfsg-1~deb11u3
Références
- advisory security.netapp.com
- advisory debian.org
- advisory nvd.nist.gov
- advisory github.com
- web hackerone.com
- web cert-portal.siemens.com