CryptoJS vulnerability

2024-04-2500:00:00

ubuntu.com

cryptojs

vulnerability

cryptographic default configuration

ubuntu

remote attacker

sensitive information

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

31.5%

JSON

Releases

Ubuntu 22.04 LTS
Ubuntu 20.04 LTS
Ubuntu 18.04 ESM
Ubuntu 16.04 ESM

Packages

cryptojs - collection of cryptographic algorithms implemented in JavaScript

Details

Thomas Neil James Shadwell discovered that CryptoJS was using an insecure
cryptographic default configuration. A remote attacker could possibly use
this issue to expose sensitive information.

OSVersionArchitecturePackageVersionFilename
Ubuntu22.04noarchlibjs-cryptojs< 3.1.2+dfsg-3ubuntu0.22.04.1~esm1UNKNOWN
Ubuntu22.04noarchlibjs-cryptojs< 3.1.2+dfsg-3UNKNOWN
Ubuntu20.04noarchlibjs-cryptojs< 3.1.2+dfsg-2ubuntu0.20.04.1UNKNOWN
Ubuntu18.04noarchlibjs-cryptojs< 3.1.2+dfsg-2ubuntu0.18.04.1~esm1UNKNOWN
Ubuntu18.04noarchlibjs-cryptojs< 3.1.2+dfsg-2UNKNOWN
Ubuntu16.04noarchlibjs-cryptojs< 3.1.2+dfsg-2ubuntu0.16.04.1~esm1UNKNOWN
Ubuntu16.04noarchlibjs-cryptojs< 3.1.2+dfsg-2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	22.04	noarch	libjs-cryptojs	< 3.1.2+dfsg-3ubuntu0.22.04.1~esm1	UNKNOWN
Ubuntu	22.04	noarch	libjs-cryptojs	< 3.1.2+dfsg-3	UNKNOWN
Ubuntu	20.04	noarch	libjs-cryptojs	< 3.1.2+dfsg-2ubuntu0.20.04.1	UNKNOWN
Ubuntu	18.04	noarch	libjs-cryptojs	< 3.1.2+dfsg-2ubuntu0.18.04.1~esm1	UNKNOWN
Ubuntu	18.04	noarch	libjs-cryptojs	< 3.1.2+dfsg-2	UNKNOWN
Ubuntu	16.04	noarch	libjs-cryptojs	< 3.1.2+dfsg-2ubuntu0.16.04.1~esm1	UNKNOWN
Ubuntu	16.04	noarch	libjs-cryptojs	< 3.1.2+dfsg-2	UNKNOWN