CVE-2024-1631

Katalog CVE

CVSS 9.1 · Critical EPSS 0,88%

Kerentanan Use of Hard-coded Cryptographic Key pada dfinity icp-js-core. Skor CVSS 3.1 9.1 (Critical) menurut CNA.

Deskripsi (NVD)

Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using secure randomness. However, a recent change broke this guarantee and uses an insecure seed for key pair generation. Since the private key of this identity (535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe) is compromised, one could lose funds associated with the principal on ledgers or lose access to a canister where this principal is the controller.

Rincian

Terbit di NVD

21 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-321: Use of Hard-coded Cryptographic Key
CWE-330: Use of Insufficiently Random Values

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 58,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dfinity/agent-js/security/advisories/GHSA-c9vv-fhgv-cjc3 exploit · advisory vendor
• https://github.com/dfinity/agent-js/pull/851 issue tracking · patch
• https://agent-js.icp.xyz/identity/index.html broken link
• https://github.com/dfinity/agent-js product
• https://www.npmjs.com/package/@dfinity/identity/v/1.0.1 product