GHSA-qg3g-2mgh-33j8
Sensitive Data Exposure in msrcrypto
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2018-8319
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Versions of `msrcrypto` prior to 1.4.1 are vulnerable to Sensitive Data Exposure. The package's Elliptic Curve Cryptography (ECC) implementation may leak information about a server's private ECC key. It can also allow attackers to craft invalid ECDSA signatures that pass as valid. There is no published proof-of-concept for this vulnerability. ## Recommendation Upgrade to version 1.4.1 or later.
Paquets affectés
| Paquet | Versions |
|---|---|
| npm · msrcrypto | introduced 0, fixed 1.4.1 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2018-8319 ADVISORY
- https://github.com/advisories/GHSA-qg3g-2mgh-33j8 ADVISORY
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319 WEB
- https://www.npmjs.com/advisories/1112 WEB
- http://www.securityfocus.com/bid/104655 WEB
- http://www.securitytracker.com/id/1041268 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |