Incorrect Calculation in the MSR JavaScript Cryptography Library

Description

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography (ECC) implementation.

Recommendation

Update the msrcrypto package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.5.8
• Patched version(s): 1.5.8

References

• GHSA-9x9j-836w-8f55
• portal.msrc.microsoft.com
• CVE-2020-1026
• CWE-682
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Improper Input Validation in Google Closure Library - CVE-2020-8910
• Expo on iOS is insecure due incorrect security attribute application - CVE-2020-24653
• Insecure serialization leading to RCE in serialize-javascript - CVE-2020-7660
• Uncontrolled Resource Consumption in fun-map - CVE-2020-7644

You might also like:

How to Secure your NodeJs Express Javascript Application - part 2

Secure Coding 101: How to Use Random Function

SmartScanner 2.3: Smarter JavaScript Detection, Faster Scans, and Powerful CLI Enhancements

Tags:

npm

msrcrypto