Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-35255

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.

Published

2022-12-05T22:15:10.513

Last Modified

2025-04-24T14:15:32.070

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.1 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-338
  • Type: Primary
    CWE-338
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application nodejs node.js ≤ 15.14.0 Yes
Application nodejs node.js ≤ 16.12.0 Yes
Application nodejs node.js < 16.17.1 Yes
Application nodejs node.js < 18.9.1 Yes
Application siemens sinec_ins < 1.0 Yes
Application siemens sinec_ins 1.0 Yes
Application siemens sinec_ins 1.0 Yes
Application siemens sinec_ins 1.0 Yes
Operating System debian debian_linux 11.0 Yes
References