agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`

Description

The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using secure randomness.

Recommendation

Update the @dfinity/auth-client package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.20.0-beta.0, < 1.0.1
• Patched version(s): 1.0.1

References

• GHSA-c9vv-fhgv-cjc3
• agent-js.icp.xyz
• www.npmjs.com
• CVE-2024-1631
• CWE-321
• CWE-330
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` - @dfinity/identity - CVE-2024-1631
• @cat5th/key-serializer Prototype Pollution vulnerability - CVE-2024-39018
• Generation of Error Message Containing Sensitive Information in zsa - CVE-2024-37162
• Modified package published to npm, containing malware that exfiltrates private key material - CVE-2024-54134

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@dfinity/auth-client