Insecure Cryptography Algorithm in simple-crypto-js

Description

Versions of simple-crypto-js prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.

Recommendation

Update the simple-crypto-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.0
• Patched version(s): 2.3.0

References

• GHSA-5v7r-jg9r-vq44
• robertheaton.com
• snyk.io
• CWE-327
• OWASP 2021-A2

Related Issues

• Insecure Cryptography Algorithm in parsel - Vulnerability
• @nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys - Vulnerability
• Insecure Default Configuration in tesseract.js - Vulnerability
• Svelte: SSR XSS via Insecure Promise Serialization in hydratable - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

simple-crypto-js