Description
A bug in the pseudo-random number generator used by keypair versions up to and including 1.0.3 could allow for weak RSA key generation. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim. We recommend replacing any RSA keys that were generated using keypair version 1.0.
Recommendation
Update the keypair package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.0.4
- Patched version(s): 1.0.4
References
Could your website be exposed too?
SmartScanner can check your website for Insecure random number generation in keypair and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Insecure password handling vulnerability in Strapi - CVE-2021-46440
- crypto-js uses insecure random numbers - CVE-2020-36732
- agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` - @dfinity/identity - CVE-2024-1631
- agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` - CVE-2024-1631
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023