GitHub Advisoryadvisory · npm

GHSA-3w3w-pxmm-2w2j crypto-js uses insecure random numbers

MEDIUM Published 2023-06-12 Modified 2026-03-16 Official page ↗

Aliases: CVE-2020-36732
Ecosystem: npm
Packages: crypto-js
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses: CWE-330, CWE-331
Reviewed: 2023-06-13

Affected packages

• npm crypto-js: >= 3.2.0, < 3.2.1 → fixed in 3.2.1

Description

The crypto-js package 3.2.0 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

Alias · CVE (1)

CVE-2020-36732 The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the… vulnerability

Weakness · CWE (2)

CWE-330 Use of Insufficiently Random Values weakness
CWE-331 Insufficient Entropy weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2020-36732 advisory
https://github.com/brix/crypto-js/issues/254 web
https://github.com/brix/crypto-js/issues/256 web
https://github.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b web
https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5 web
https://github.com/brix/crypto-js/commit/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b web
https://github.com/brix/crypto-js package
https://github.com/brix/crypto-js/compare/3.2.0...3.2.1 web
https://security.netapp.com/advisory/ntap-20230706-0003 web
https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472 web