@abcpros/xpicash (>=1.1.1, <=1.1.2), @alakipalaki/handshake (>=0.1.0-305766c0, <=3.1.0) +71 more potentially affected by CVE-2023-50475 via bsock (>=0.0.2, <=0.1.11)

bsock NPM version =0.0.2, =1.1.1, =0.1.0-305766c0, =0.1.0-305766c0, =0.0.12, =1.0.0, =1.0.0, =0.0.12, =0.0.1, =1.0.1, =1.3.0 - adeps 4.99.0 - aliasing 0.1.0 - atomicagent 0.1.0 and more Source cves: CVE-2023-50475 Source advisory: OSV:GHSA-JJ93-39PF-7MCF...

CVE-2023-50475

CVE-2023-50475 affects bcoin-org/bcoin v2.2.0 in the bsock component, via the vendor\faye-websocket.js allowing remote attackers to disclose sensitive information by using weak hashing algorithms (e.g., MD5/SHA1). The Red Hat/Veracode/OSV reports corroborate a weakness in the websocket hashing us...