crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
- Severity:
- High
Description
No description available.
Recommendation
Update the crypto-js package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.2.0
- Patched version(s): 4.2.0
References
- GHSA-xwcq-pm8m-c4vf
- lists.debian.org
- CVE-2023-46233
- CWE-327
- CWE-328
- CWE-916
- CAPEC-310
- OWASP 2021-A2
- OWASP 2021-A6
Related Issues
- crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain - CVE-2026-71851
- crypto-js uses insecure random numbers - CVE-2020-36732
- Making all attributes on a content-type public without noticing it - @strapi/utils - CVE-2023-34093
- `chainId` may be outdated if user changes chains as part of connection in @web3-react - @web3-react/metamask - CVE-2023-30543
You might also like:
- Tags:
- npm
- crypto-js
Anything's wrong? Let us know Last updated on February 01, 2024