GitHub Advisoryadvisory · npm

GHSA-5wg4-74h6-q47v Integer Overflow or Wraparound and Use of a Broken or Risky Cryptographic Algorithm in bcrypt

MEDIUM Published 2020-08-20 Modified 2021-07-29 Official page ↗

Aliases: CVE-2020-7689
Ecosystem: npm
Packages: bcrypt
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses: CWE-190, CWE-327
Reviewed: 2020-08-20

Affected packages

• npm bcrypt: < 5.0.0 → fixed in 5.0.0

Description

In bcrypt (npm package) before version 5.0.0, data is truncated wrong when its length is greater than 255 bytes.

Related

Alias · CVE (1)

CVE-2020-7689 Data is truncated wrong when its length is greater than 255 bytes. vulnerability

Weakness · CWE (2)

CWE-190 Integer Overflow or Wraparound weakness
CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References