GHSA-3w3w-pxmm-2w2j

crypto-js uses insecure random numbers

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-36732

Packages

Ecosystem	Package	Affected	Fixed in
npm	crypto-js	>= 3.2.0, < 3.2.1	3.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

The crypto-js package 3.2.0 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-36732 advisory
https://github.com/brix/crypto-js/issues/254 web
https://github.com/brix/crypto-js/issues/256 web
https://github.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b web
https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5 web
https://github.com/brix/crypto-js/commit/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b web
https://github.com/brix/crypto-js package
https://github.com/brix/crypto-js/compare/3.2.0...3.2.1 web
https://security.netapp.com/advisory/ntap-20230706-0003 web
https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472 web