CVE-2021-41117

keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other libraries where possible, including node-forge. An issue was discovered where this library was generating identical RSA keys used in SSH. This wou...

CVE-2021-41117

keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other libraries where possible, including node-forge. An issue was discovered where this library was generating identical RSA keys used in SSH. This wou...

Path traversal

keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other libraries where possible, including node-forge. An issue was discovered where this library was generating identical RSA keys used in SSH. This wou...

CVE-2021-41117

CVE-2021-41117 concerns the keypair library (JS RSA key generator) generating identical P, Q (and N) values for SSH keys due to a weak RNG. The root cause is a non-cryptographically secure fallback RNG: when window.crypto.getRandomValues() is unavailable, keypair seeds an AES-CMAC counter with a ...

7ghost (>=4.11.0, <=4.11.46), @heroku-cli/plugin-java (>=3.0.0, <=3.1.1) +55 more potentially affected by CVE-2021-41117 via keypair (>=0.0.5, <=1.0.3)

keypair NPM version =0.0.5, =4.11.0, =3.0.0, =2.3.1, =3.41.6, =1.0.1, =1.0.0, =0.1.2, =0.2.1, =0.4.0, =0.1.2, =0.1.2, =0.1.11 and more Source cves: CVE-2021-41117 Source advisory: MEND:CVE-2021-41117...

CVE-2021-41117

keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other libraries where possible, including node-forge. An issue was discovered where this library was generating identical RSA keys used in SSH. This wou...

7ghost (>=4.11.0, <=4.11.46), @heroku-cli/plugin-java (>=3.0.0, <=3.1.1) +49 more potentially affected by CVE-2021-41117 via keypair (>=1.0.0, <=1.0.3)

keypair NPM version =1.0.0, =4.11.0, =3.0.0, =2.3.1, =3.41.6, =1.0.1, =1.0.0, =0.1.2, =0.2.1, =0.4.0, =0.1.2, =0.1.2, =0.1.11 and more Source cves: CVE-2021-41117 Source advisory: OSV:GHSA-3F99-HVG4-QJWJ...

7ghost (>=4.11.0, <=4.11.46), @heroku-cli/plugin-java (>=3.0.0, <=3.1.1) +49 more potentially affected by CVE-2021-41117 via keypair (>=1.0.0, <=1.0.3)

keypair NPM version =1.0.0, =4.11.0, =3.0.0, =2.3.1, =3.41.6, =1.0.1, =1.0.0, =0.1.2, =0.2.1, =0.4.0, =0.1.2, =0.1.2, =0.1.11 and more Source cves: CVE-2021-41117 Source advisory: GHSA-3F99-HVG4-QJWJ...

Insecure random number generation in keypair

Description and Impact A bug in the pseudo-random number generator used by keypair versions up to and including 1.0.3 could allow for weak RSA key generation. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim. We recomme...

GHSA-3F99-HVG4-QJWJ Insecure random number generation in keypair

Description and Impact A bug in the pseudo-random number generator used by keypair versions up to and including 1.0.3 could allow for weak RSA key generation. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim. We recomme...

PT-2021-23101

Name of the Vulnerable Software and Affected Versions keypair versions up to and including 1.0.3 Description The keypair library, a JavaScript RSA PEM key generator, has a poor random number generation issue. This is due to the library not relying entirely on a platform-provided CSPRNG and instea...

Keypair code issue vulnerabilities

Keypair is an open source package. It is used to generate RSA PEM key pairs in pure JS. Keypair has a code issue vulnerability that stems from. An issue was found when this library was generating the same RSA keys used in SSH. This would mean that the library is generating the same P, Q and...

CVE-2021-41117: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other libraries where possible, including node-forge. An issue was discovered where this library was generating identical RSA keys used in SSH. This wou...

CVE-2020-10590

Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port 8800 on the Replicated Classic server could retrieve the TLS Keypair Cert and Key used to configure...

Design/Logic Flaw

Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port 8800 on the Replicated Classic server could retrieve the TLS Keypair Cert and Key used to configure...

CVE-2020-10590

CVE-2020-10590 affects Replicated Classic 2.x. The issue is an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port (8800) on a Replicated Classic server could retrieve the TLS keypair (certif...

CVE-2020-10590: Undefined Security Weakness

Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port 8800 on the Replicated Classic server could retrieve the TLS Keypair Cert and Key used to configure...

PT-2021-9160

Name of the Vulnerable Software and Affected Versions Replicated Classic versions 2.x Description The issue concerns an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port 8800 on the...

Exploit for Path Traversal in Vmware Cloud_Foundation

vsphereyeeter.sh is an automated bash script to exploit vuln...

bcash-instadump (>=0.3.3, <=0.4.0), bcoin-stratum (0.0.1) +2 more potentially affected by CVE-2018-17145 via bcoin (>=1.0.0-beta, <=1.0.0-beta.14)

bcoin NPM version =1.0.0-beta, =0.3.3, =1.0.0, =2.1.1 - ihan 0.4.0 Source cves: CVE-2018-17145 Source advisory: GHSA-HX3R-JV9Q-85JW...