crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

Description

No description available.

Recommendation

Update the crypto-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.2.0
• Patched version(s): 4.2.0

References

• GHSA-xwcq-pm8m-c4vf
• lists.debian.org
• CVE-2023-46233
• CWE-327
• CWE-328
• CWE-916
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard - CVE-2023-46133
• crypto-js uses insecure random numbers - CVE-2020-36732
• Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect - CVE-2024-30261
• Follow Redirects improperly handles URLs in the url.parse() function - CVE-2023-26159

Tags:

npm

crypto-js