by Kastro CVE-2022-35255
NodeJS Node — A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKe…
Description · from the CVE record
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
Affected
ProductAffectedFixed inSource
Node4.0 – < 4.*4.*CNA
Node5.0 – < 5.*5.*CNA
Node6.0 – < 6.*6.*CNA
Node7.0 – < 7.*7.*CNA
Node8.0 – < 8.*8.*CNA
Node9.0 – < 9.*9.*CNA
Node10.0 – < 10.*10.*CNA
Node11.0 – < 11.*11.*CNA
Node12.0 – < 12.*12.*CNA
Node13.0 – < 13.*13.*CNA
Node15.0 – < 15.*15.*CNA
Node17.0 – < 17.*17.*CNA
Scores by source
CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total