Description
Math.random and crypto.getRandomValues methods failed to use sufficiently random values. The initial value to seed the CSPRNG (cryptographically secure pseudorandom number generator) was baked-in to the final WebAssembly module meaning the sequence of numbers generated was predictable for that specific WebAssembly module.
Recommendation
Update the @fastly/js-compute package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.4.0, < 0.5.3
- Patched version(s): 0.5.3
References
Could your website be exposed too?
SmartScanner can check your website for Fastly Compute@Edge JS Runtime has fixed random number seed during compilation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @fastly/js-compute has a use-after-free in some host call implementations - CVE-2024-38375
- Insecure random number generation in keypair - CVE-2021-41117
- JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-esm-runtime - CVE-2022-36083
- JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-cjs-runtime - CVE-2022-36083
You might also like:
See something that needs correcting? Let us knowUpdated January 30, 2023