GitHub Advisoryadvisory · npm

GHSA-qg3g-2mgh-33j8 Sensitive Data Exposure in msrcrypto

CRITICAL Published 2018-09-10 Modified 2021-09-16 Official page ↗
Aliases
CVE-2018-8319
Ecosystem
npm
Packages
msrcrypto
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-682
Reviewed
2020-06-16

Affected packages

• npm msrcrypto: < 1.4.1 → fixed in 1.4.1

Description

Versions of `msrcrypto` prior to 1.4.1 are vulnerable to Sensitive Data Exposure. The package's Elliptic Curve Cryptography (ECC) implementation may leak information about a server's private ECC key. It can also allow attackers to craft invalid ECDSA signatures that pass as valid. There is no published proof-of-concept for this vulnerability. Recommendation Upgrade to version 1.4.1 or later.

Related

Alias · CVE (1)

  • CVE-2018-8319 A Security Feature Bypass vulnerability exists in MSR JavaScript Cryptography Library that is caused by incorrect arithmetic computations,… vulnerability

Weakness · CWE (1)

  • CWE-682 Incorrect Calculation weakness

References