GHSA-h5vj-f7r9-w564

Source

https://github.com/advisories/GHSA-h5vj-f7r9-w564

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-h5vj-f7r9-w564/GHSA-h5vj-f7r9-w564.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h5vj-f7r9-w564

Published

2020-09-01T21:22:35Z

Modified

2021-10-01T13:30:18Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Entropy Backdoor in text-qrcode

Details

All versions of text-qrcode contain malicious code that overwrites the randomBytes method for the crypto module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being returned, but one that is easily guessable.

Recommendation

Uninstall text-qrcode immediately. If the module was used to generate entropy that is load bearing, all such instances of generated entropy must be replaced. This includes things like bitcoin wallets, private keys, encrypted messages, etc.

Database specific

{
    "cwe_ids":  [
        "CWE-506"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:34:01Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

https://www.npmjs.com/advisories/738

Affected packages

npm / text-qrcode

Package

Name: text-qrcode; View open source insights on deps.dev
Purl: pkg:npm/text-qrcode

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-h5vj-f7r9-w564/GHSA-h5vj-f7r9-w564.json"