agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` - @dfinity/identity

Description

The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using secure randomness.

Recommendation

Update the @dfinity/identity package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.20.0-beta.0, < 1.0.1
• Patched version(s): 1.0.1

References

• GHSA-c9vv-fhgv-cjc3
• agent-js.icp.xyz
• www.npmjs.com
• CVE-2024-1631
• CWE-321
• CWE-330
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` - CVE-2024-1631
• Lobe Chat API Key Leak - CVE-2024-37895
• @cat5th/key-serializer Prototype Pollution vulnerability - CVE-2024-39018
• tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@dfinity/identity