GHSA-qg3g-2mgh-33j8

Source

https://github.com/advisories/GHSA-qg3g-2mgh-33j8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/09/GHSA-qg3g-2mgh-33j8/GHSA-qg3g-2mgh-33j8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qg3g-2mgh-33j8

Aliases

CVE-2018-8319

Published

2018-09-10T15:19:49Z

Modified

2023-11-08T04:00:27.239122Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Sensitive Data Exposure in msrcrypto

Details

Versions of msrcrypto prior to 1.4.1 are vulnerable to Sensitive Data Exposure. The package's Elliptic Curve Cryptography (ECC) implementation may leak information about a server's private ECC key. It can also allow attackers to craft invalid ECDSA signatures that pass as valid. There is no published proof-of-concept for this vulnerability.

Recommendation

Upgrade to version 1.4.1 or later.

Database specific

{
    "cwe_ids": [
        "CWE-682"
    ],
    "severity": "CRITICAL",
    "github_reviewed_at": "2020-06-16T21:51:47Z",
    "github_reviewed": true,
    "nvd_published_at": null
}

References

Affected packages

npm / msrcrypto

Package

Name: msrcrypto; View open source insights on deps.dev
Purl: pkg:npm/msrcrypto

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/09/GHSA-qg3g-2mgh-33j8/GHSA-qg3g-2mgh-33j8.json"