Log in Start free

Vulnerability · Published Dec 5, 2022 · Assigned by hackerone

CVE-2022-35255

Critical 9.1

In plain English

A critical-severity security flaw in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)2.1%top 18.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8nodejs1:16.17.1-1.module_el8.6.0+3328+2e4711d7ALSA-2022:6964
AlmaLinux:8nodejs1:18.9.1-1.module_el8.7.0+3343+ea2b7901ALSA-2022:7821
AlmaLinux:9nodejs1:16.17.1-1.el9_0ALSA-2022:6963
AlmaLinux:8nodejs-devel1:18.9.1-1.module_el8.7.0+3343+ea2b7901ALSA-2022:7821
AlmaLinux:8nodejs-devel1:16.17.1-1.module_el8.6.0+3328+2e4711d7ALSA-2022:6964
AlmaLinux:8nodejs-docs1:16.17.1-1.module_el8.6.0+3328+2e4711d7ALSA-2022:6964
AlmaLinux:8nodejs-docs1:18.9.1-1.module_el8.7.0+3343+ea2b7901ALSA-2022:7821
AlmaLinux:9nodejs-docs1:16.17.1-1.el9_0ALSA-2022:6963
AlmaLinux:8nodejs-full-i18n1:18.9.1-1.module_el8.7.0+3343+ea2b7901ALSA-2022:7821
AlmaLinux:8nodejs-full-i18n1:16.17.1-1.module_el8.6.0+3328+2e4711d7ALSA-2022:6964
AlmaLinux:9nodejs-full-i18n1:16.17.1-1.el9_0ALSA-2022:6963
AlmaLinux:9nodejs-libs1:16.17.1-1.el9_0ALSA-2022:6963
AlmaLinux:8nodejs-nodemon2.0.19-2.module_el8.6.0+3261+490666b3ALSA-2022:6964
AlmaLinux:8nodejs-nodemon2.0.19-1.module_el8.7.0+3343+ea2b7901ALSA-2022:7821
AlmaLinux:8nodejs-packaging25-1.module_el8.5.0+2605+45d748afALSA-2022:6964
AlmaLinux:8nodejs-packaging2021.06-4.module_el8.7.0+3343+ea2b7901ALSA-2022:7821
AlmaLinux:8nodejs-packaging-bundler2021.06-4.module_el8.7.0+3343+ea2b7901ALSA-2022:7821
AlmaLinux:8npm1:8.19.1-1.18.9.1.1.module_el8.7.0+3343+ea2b7901ALSA-2022:7821
AlmaLinux:8npm1:8.15.0-1.16.17.1.1.module_el8.6.0+3328+2e4711d7ALSA-2022:6964
AlmaLinux:9npm1:8.15.0-1.16.17.1.1.el9_0ALSA-2022:6963
Alpine:v3.20nodejs16.17.1-r0ALPINE-CVE-2022-35255
Alpine:v3.21nodejs16.17.1-r0ALPINE-CVE-2022-35255
Alpine:v3.22nodejs16.17.1-r0ALPINE-CVE-2022-35255
Alpine:v3.23nodejs16.17.1-r0ALPINE-CVE-2022-35255
Alpine:v3.24nodejs16.17.1-r0ALPINE-CVE-2022-35255
Alpine:v3.20nodejs-current18.9.1-r0ALPINE-CVE-2022-35255
Alpine:v3.21nodejs-current18.9.1-r0ALPINE-CVE-2022-35255
Alpine:v3.22nodejs-current18.9.1-r0ALPINE-CVE-2022-35255
Alpine:v3.23nodejs-current18.9.1-r0ALPINE-CVE-2022-35255
Alpine:v3.24nodejs-current18.9.1-r0ALPINE-CVE-2022-35255
Debian:12nodejs18.10.0+dfsg-1DEBIAN-CVE-2022-35255
Debian:13nodejs18.10.0+dfsg-1DEBIAN-CVE-2022-35255
Debian:14nodejs18.10.0+dfsg-1DEBIAN-CVE-2022-35255
Rocky Linux:8nodejs1:16.17.1-1.module+el8.6.0+1046+80feca58RLSA-2022:6964
Rocky Linux:8nodejs1:18.9.1-1.module+el8.7.0+1072+5b168780RLSA-2022:7821
Rocky Linux:9nodejs1:16.17.1-1.el9_0RLSA-2022:6963
Rocky Linux:8nodejs-nodemon0:2.0.19-2.module+el8.6.0+1046+80feca58RLSA-2022:6964
Rocky Linux:8nodejs-nodemon0:2.0.19-2.module+el8.6.0+1003+ae94235aRLSA-2022:6964
Rocky Linux:8nodejs-nodemon0:2.0.19-1.module+el8.7.0+1072+5b168780RLSA-2022:7821
Rocky Linux:8nodejs-packaging0:25-1.module+el8.6.0+1046+80feca58RLSA-2022:6964
Rocky Linux:8nodejs-packaging0:25-1.module+el8.5.0+702+221f14e6RLSA-2022:6964
Rocky Linux:8nodejs-packaging0:2021.06-4.module+el8.7.0+1072+5b168780RLSA-2022:7821

Affected products (as reported)

VendorProductVersions
NodeJS Node 4.0 – before 4.*5.0 – before 5.*6.0 – before 6.*7.0 – before 7.*8.0 – before 8.*9.0 – before 9.*10.0 – before 10.*11.0 – before 11.*

Weakness: CWE-338 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References