GHSA-MPJ8-Q39X-WQ5H crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

Impact Summary Crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standardOWASP PBKDF2 Cheatsheet. This is because it both 1 defaults to SHA1SHA1 wiki, a cryptographic hash algorithm considered insecure since at leas...

@aarc-dev/deposit-widget (>=0.0.1 <=0.0.9), @aarc-xyz/deposit-widget (>=0.0.1 <=0.0.3) +243 more potentially affected by CVE-2023-46133 via crypto-es (>=1.2.7 <=2.0.4)

crypto-es NPM version =1.2.7, =0.0.1, =0.0.1, =1.0.0, =2.1.5, =0.1.0, =0.1.0-rc2, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.20, =1.0.0, =0.4.2, =0.2.1-5, =0.2.1-6 and more Source cves: CVE-2023-46133 Source advisory: OSV:GHSA-MPJ8-Q39X-WQ5H...

crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

Impact Summary Crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standardOWASP PBKDF2 Cheatsheet. This is because it both 1 defaults to SHA1SHA1 wiki, a cryptographic hash algorithm considered insecure since at leas...

CVE-2023-46233

crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm...

CVE-2023-46233 crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm...

CVE-2023-46233 crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm...

CVE-2023-46233

CVE-2023-46233 affects crypto-js in Crypto-JS prior to 4.2.0. The PBKDF2 implementation uses SHA1 and a fixed iteration count of 1,000, making it far weaker than the 1993 spec and substantially weaker than current standards. Reported impact is high for password protection and signature generation...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.8.3 security and bug fix updates

Red Hat Advanced Cluster Management for Kubernetes 2.8.3 General Availability release images, which provide security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

M-09 Unmitigated

Lines of code Vulnerability details Mitigation of M-09: Issue not mitigated Link to Issue: code-423n4/2023-09-asymmetry-findings31 Comments The sponsor has acknowledged the issue but decided to not mitigate it. Acknowledged and did not fix, plan to upgrade a fix in the future --- The text was...

at _modifyCollateralBalance when locking and generating debt your wad is going to be negative number but at the token Collateral mapping should not have any negative numbers

Lines of code Vulnerability details Impact the protocol will not work, all functions will not work Proof of Concept you cannot set negative number to uint256 Tools Used manual Recommended Mitigation Steps change the mapping to : mappingbytes32 cType = mappingaddress safe = int256 wad public...

PT-2023-29917

Name of the Vulnerable Software and Affected Versions crypto-js versions prior to 4.2.0 Description The crypto-js library has a weakened PBKDF2 configuration, which is 1,000 times weaker than originally specified in 1993 and at least 1,300,000 times weaker than the current industry standard. This...

PT-2023-31803 · Zephyr · Zephyr Stm32 Crypto Driver

Name of the Vulnerable Software and Affected Versions: Zephyr STM32 Crypto driver affected versions not specified Description: A potential buffer overflow vulnerability exists in the Zephyr STM32 Crypto driver. Recommendations: At the moment, there is no information about a newer version that...

Amazon Linux AMI : amazon-ssm-agent (ALAS-2023-1866)

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1705.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1866 advisory. 2023-10-30: CVE-2023-24540 was added to this advisory. The x/crypto/ssh package before...

M-06 Unmitigated

Lines of code Vulnerability details Mitigation of M-06: Issue NOT mitigated Mitigated issue M-06: Missing deadline check for AfEth actions The issue was missing deadline checks for deposits and withdrawals. Mitigation review - missing deadline for rewards Deadline parameters have been added to...

M-02 Unmitigated

Lines of code Vulnerability details Mitigation of M-02: Issue not mitigated Link to Issue: code-423n4/2023-09-asymmetry-findings54 Comments The sponsor has acknowledged the issue but decided to not mitigate it. Acknowledged and did not fix, plan to upgrade a fix in the future --- The text was...

crypto-js encryption issue vulnerability

crypto-js is a JavaScript library open-sourced by Brix. A security vulnerability exists in crypto-js versions prior to 4.2.0 that stems from the use of an insecure cryptographic hash algorithm...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2023-388)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-388 advisory. The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. CVE-2021-43565 A broken cryptographic algorithm flaw was foun...

Important: Red Hat Security Advisory: Cryostat security update

An update is now available for Cryostat 2 on RHEL 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in th...

Upgraded Q -> 3 from #102 [1697893134448]

Judge has assessed an item in Issue 102 as 3 risk. The relevant finding follows: QA-02 Missing requiresApprovedCaller modifier --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #854 [1697894788598]

Judge has assessed an item in Issue 854 as 2 risk. The relevant finding follows: Virtual Account cannot withdraw ERC1155 directly --- The text was updated successfully, but these errors were encountered: All reactions...