CVE-2022-35255

Katalog CVE

CVSS 9.1 · Critical EPSS 2,1%

Kerentanan Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) pada nodejs node.js, siemens sinec ins +1 lainnya. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.

Rincian

Terbit di NVD

5 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf advisory pihak ketiga
• https://hackerone.com/reports/1690000 exploit · issue tracking · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230113-0002/ advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5326 advisory pihak ketiga