GitHub Advisoryadvisory · npm

GHSA-rq8g-5pc5-wrhr Insufficient Entropy in cryptiles

CRITICAL Published 2018-09-11 Modified 2026-06-08 Official page ↗
Aliases
CVE-2018-1000620
Ecosystem
npm
Packages
cryptiles
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-331
Reviewed
2020-06-16

Affected packages

• npm cryptiles: >= 4.0.0, < 4.1.2 → fixed in 4.1.2 • npm cryptiles: >= 3.1.0, < 3.1.3 → fixed in 3.1.3

Description

Versions of `cryptiles` prior to 4.1.2 are vulnerable to Insufficient Entropy. The `randomDigits()` method does not provide sufficient entropy and its generates digits that are not evenly distributed. Recommendation Upgrade to version 4.1.2. The package is deprecated and has been moved to `@hapi/cryptiles` and it is strongly recommended to use the maintained package.

Related

Alias · CVE (1)

  • CVE-2018-1000620 Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result… vulnerability

Weakness · CWE (1)

  • CWE-331 Insufficient Entropy weakness

References