Insecure Cryptography Algorithm in parsel

Description

All versions of parsel use an insecure cryptography algorithm. The package uses aes-256-cbc without integrity checks, which renders the ciphertext vulnerable to bit-flipping attacks.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0.0.0

References

• GHSA-wqgx-4q47-j2w5
• www.npmjs.com
• CWE-327
• OWASP 2021-A2

Related Issues

• Insecure Cryptography Algorithm in simple-crypto-js - Vulnerability
• @nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys - Vulnerability
• Hardcoded Initialization Vector in parsel - Vulnerability
• Insecure Default Configuration in tesseract.js - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

parsel