A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
References
Link | Resource |
---|---|
https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf | Third Party Advisory |
https://hackerone.com/reports/1690000 | Exploit Issue Tracking Third Party Advisory |
https://security.netapp.com/advisory/ntap-20230113-0002/ | Third Party Advisory |
https://www.debian.org/security/2023/dsa-5326 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
01 Mar 2023, 15:03
Type | Values Removed | Values Added |
---|---|---|
References | (CONFIRM) https://security.netapp.com/advisory/ntap-20230113-0002/ - Third Party Advisory | |
References | (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf - Third Party Advisory | |
References | (DEBIAN) https://www.debian.org/security/2023/dsa-5326 - Third Party Advisory | |
First Time |
Debian
Siemens sinec Ins Debian debian Linux Siemens |
|
CPE | cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:* |
26 Jan 2023, 21:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
13 Jan 2023, 09:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
10 Jan 2023, 13:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
08 Dec 2022, 15:58
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
|
First Time |
Nodejs
Nodejs node.js |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
References | (MISC) https://hackerone.com/reports/1690000 - Exploit, Issue Tracking, Third Party Advisory | |
CWE | CWE-338 |
05 Dec 2022, 23:40
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-12-05 22:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-35255
Mitre link : CVE-2022-35255
CVE.ORG link : CVE-2022-35255
JSON object : View
Products Affected
siemens
- sinec_ins
nodejs
- node.js
debian
- debian_linux
CWE
CWE-338
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)